Pair-Aware Optimization: Coordinating Exploration and Refinement for Jailbreaking LLM Agents

Key points

• Existing optimization-based jailbreak attacks primarily employ first-order (FO) methods that leverage gradient information or zeroth-order (ZO) methods that rely on function-value feedback.1
• We systematically investigate four strategies: pure ZO, pure FO, ZO->FO, and FO->ZO, and develop a ZO-FO framework that explores adversarial prefixes through ZO optimization and refines their corresponding suffixes through FO optimization.1
• To coordinate the two processes, we introduce Pair-aware optimization, which retains multiple prefix candidates, conditionally refines their suffixes and selects among the resulting prefix-suffix pairs.1
• Experiments across malicious-instruction and malicious-environment benchmarks demonstrate that hybrid optimization improves attack effectiveness over single-optimizer methods, while optimization order substantially influences performance.1

Sources (1)

• [1]Pair-Aware Optimization: Coordinating Exploration and Refinement for Jailbreaking LLM Agents
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 17, 07:13 PM

  Large Language Model (LLM) agents are vulnerable to adversarial inputs that induce attacker-specified malicious behaviors, commonly referred to as jailbreaking.

  Existing optimization-based jailbreak attacks primarily employ first-order (FO) methods that leverage gradient information or zeroth-order (ZO) methods that rely on function-value feedback.

Extractive summary: sentences quoted from the sources.