Endless Jailbreaks with Bijection Learning

## Abstract

Abstract Despite extensive safety training, LLMs are vulnerable to adversarial inputs. In this work, we introduce a simple but powerful attack paradigm, bijection learning , that yields a practically endless set of jailbreak prompts. We exploit language models’ advanced reasoning capabilities to teach them invertible languages (bijections) in context, pass encoded queries to the model to bypass built-in safety mechanisms, and finally decode responses back into English, yielding helpful replies to harmful requests.
Our approach proves effective on a wide range of frontier language models and harm categories. Bijection learning is an automated and universal attack that grows stronger with scale: larger models with more advanced reasoning capabilities are more susceptible to bijection learning jailbreaks despite stronger safety mechanisms.

## 1 Introduction

Recently, large language models (LLMs) have been the subject of concerns about safety and potential misuse. As systems like Claude, ChatGPT, and Gemini see widespread deployment, their comprehensive world knowledge and powerful reasoning capabilities can potentially empower bad actors or amplify negative side-effects of downstream use cases. Hence, model creators have worked prudently to safeguard models by restricting harmful use. Common techniques for aligning language models include reinforcement learning with human feedback (Christiano et al., ; Bai et al., ), perplexity filtering and paraphrasing (Jain et al., ), adversarial training (Ziegler et al., ), input and output filtering (Anthropic, ; Kim et al., ), and others.

However, prior work has shown that safeguards on language models can be circumvented through adversarial modifications to model inputs. Existing jailbreaks come in many forms, including discrete token optimization (Zou et al., ; Liu et al., ; Zhu et al., ; Guo et al., ; Geisler et al., ), human-generated (Zeng et al., ; Perez & Ribeiro, ; Li et al., ) and LLM-generated prompt injections (Mehrotra et al., ; Chao et al., ), ciphers and encodings (Yong et al., ; Yuan et al., ; Jiang et al., ), many-shot jailbreaks (Anil et al., ), and miscellaneous tricks (Andriushchenko & Flammarion, ; Russinovich et al., ). The extremely wide attack surface of LLMs leads to a cat-and-mouse dynamic where model creators must continually mitigate novel jailbreaks discovered by bad actors and red-teamers.

This paper addresses a currently underexplored direction in frontier safety research: the impact of model capabilities on model safety. Previous work (Ren et al., ; Howe et al., ) has shown that scaling model capabilities can improve benchmark-based metrics of model safety, even if defense mechanisms in models do not become more sophisticated.
To the contrary, our stance is that increased capabilities can widen the attack surface of language models because strong models may successfully carry out complex instructions that weaker models cannot.
We study a model vulnerability that directly arises from increased capabilities via an extensive case study of bijection learning, a novel jailbreak that exploits models’ reasoning capabilities at different scales.

### 1.1 Our contributions

We introduce bijection learning, an attack which teaches a language model an arbitrary string-string mapping encoding English plaintext into a “bijection language.” In contrast to previous cipher-based jailbreaks, our attack does not rely on the target model’s pre-existing understanding of well-known ciphers, and instead teaches a custom encoding in-context.

Bijection learning introduces a combinatorially massive, nearly endless number of attack prompts which can be applied as automated or universal jailbreaks. Additionally, bijection learning is scale-agnostic: unlike other attacks, bijection learning has hyperparameters that control its complexity and learnability, allowing it to be tuned for models at different scales. While many other jailbreak methods only work on smaller models, we not only craft strong bijection learning jailbreaks on a wide range of models, but also find that our jailbreaks are more powerful on more capable models. By studying bijection learning, we demonstrate that new language model risk factors may emerge with scale: with greater model scale, entirely new jailbreaks can become possible, and existing jailbreaks can produce more powerfully harmful responses at higher scales.

We evaluate our bijection learning setup on a range of safety-trained frontier models of varying capabilities, including OpenAI’s GPT models and Anthropic’s Claude models. We find that:

- •
Bijection learning is an effective black-box jailbreak method that achieves an state-of-the-art Attack Success Rate (ASR) across prominent frontier models and attack datasets, including an ASR of 86.3% on HarmBench (Mazeika et al., ) when attacking Claude 3.5 Sonnet, arguably the safest frontier model at the time of writing.
- •
Bijection learning can find combinatorially many and practically endless mappings that yield successful jailbreaks. Additionally, our approach can admit universal attacks that elicit a wide range of harmful responses with a single, fixed prompt template.
- •
Varying the complexity parameters of bijection learning uncovers a scaling law of model vulnerability. In addition, certain complexities of bijection learning systematically produce certain failure modes, giving further insight into our scaling laws. Crucially, we show that bijection learning induces larger models to produce more severe harmful behaviors more frequently.

### 1.2 Related Works

#### Safety of LLMs.

Pre-trained language models have been shown to possess capabilities on a range of tasks related to dangerous fields such as chemical or biological weapons, cybersecurity, or persuasiveness (Ouyang et al., ; Bai et al., ). As such, efforts have been made towards managing these capabilities (Wallace et al., ; The White House, ; OpenAI, ) and ensuring that they cannot be elicited by malicious actors (OpenAI, ; Anthropic, ).

#### Adversarial attacks against LLMs.

Aligned LLMs are often susceptible to human-generated adversarial attacks or jailbreaks (Wei et al., ; Andriushchenko & Flammarion, ; the Prompter, ). Previous work has also explored automatic generation of new adversarial attacks (Andriushchenko et al., ; Russinovich et al., ), making use of gradients and other white-box information about the target models (Zou et al., ; Liu et al., ; Geisler et al., ; Zhu et al., ; Guo et al., ; Thompson & Sklar, ); adversarial prompt optimization using other language models in the loop (Chao et al., ; Mehrotra et al., ; Tang et al., ); and ciphers or low-resource languages (Yuan et al., ; Jiang et al., ; Barak, ; Yong et al., ). Other work has evaluated the ability of language models to learn novel synthetic languages or ciphers via finetuning (Kallini et al., ; Halawi et al., ).

#### Adversarial robustness in LLMs.

Many techniques have been proposed to address generative language models’ lack of robustness, from variations and augmentations to the safety training process (Sheshadri et al., ; Xhonneux et al., ; Zou et al., ; Zhou et al., ; Yuan et al., ; Wallace et al., ) to the use of input and output classifiers to filter potentially harmful requests or generations (Kim et al., ; Inan et al., ; Zeng et al., ).

## 2 Bijection Learning

Our bijection learning attack obfuscates a harmful query by applying a bijective map to the query. We first generate a bijection from the English alphabet to a set of strings, such as a permuted alphabet or a set of $n$-digit numbers, Morse Code sequences, or tokens from the target model’s tokenizer. We prompt the model with a multi-turn conversation history that teaches the model this mapping, followed by the harmful query encoded with this mapping. We instruct the model to provide an encoded response, which we then decode back to plaintext.

Specifically, our attack prompt consists of the following components:

- 1.
a step-by-step explanation of the bijection in a System message
- 2.
a User-Assistant conversation in which the User message is in English and the Assistant message is the corresponding translation in bijection language
- 3.
and, finally, an unsafe request already encoded in bijection language as the last User message.

Once the model gives an encoded response to our encoded harmful input, we invert the mapping to recover a harmful response in plain text, resulting in a successful jailbreak.

Figure: Figure 2: Examples of bijections taught in our attack. Characters of the alphabet, or other substrings, can be mapped to tokens, $n$-digit numbers, other characters, and more. We control the fixed size, the number of characters that map to themselves, to modulate the complexity of the bijection.
Refer to caption: extracted/5895031/images/bijection-params.png

We select a fixed sequence of translation examples and a fixed practice conversation, so our prompt template is deterministic up to the random bijective mapping (see Appendix A). Harmful model responses produced by our attack are thus fully reproducible given the original mapping used. Because bijection learning involves no manual prompt construction (aside from tuning the parameters described in §2.2), it is a fully automated attack on language models. Any single mapping also constitutes its own attack template; if the exact same mapping can effectively jailbreak many different unsafe behaviors, then bijection learning with this single, fixed mapping is a universal attack. With the right combination of bijection, translation examples, conversation examples, and fixed size (§2.2), we can reliably jailbreak state-of-the-art safety-tuned LLMs.

### 2.1 Desiderata for jailbreaks

While many jailbreaks exist in the literature, not all jailbreaks are created equal. Rather than produce one-off attacks, the scientific goal of red-teaming is to understand more fundamental model vulnerabilities in order to enable lasting progress in model safety. Towards this end, we propose the following desiderata for jailbreaks. The most pertinent jailbreaks may be:

- 1.
Black-box. These jailbreaks can be constructed without access to the target model’s internals.
- 2.
Universal and/or automated. These jailbreaks are constructed by inserting any unsafe intent into a prompt template (universal), or are automatically crafted from a combination of optimization algorithms, heuristics, and AI assistance, without any per-intent tuning or manual intervention (automated).
- 3.
Scale-agnostic. These jailbreaks are effective across models of varying scale. Notably, some jailbreaks that work for less capable models do not necessarily work for more capable models.

Several attacks in the literature are universal (Zou et al., ) or automated (Mehrotra et al., ), but our work is the first to produce attacks that are simultaneously black-box, automated, and scale-agnostic. We present bijection learning not only as a state-of-the-art jailbreak, but also as a case study for potential future work on scale-agnostic jailbreaks.

### 2.2 Parameterizing Bijection Difficulty

The effectiveness of our attack is tied to the difficulty of learning the underlying bijection. There are three parameters that control a bijection’s complexity:

- 1.
Bijection codomain: the set of possible encoding strings. We primarily study bijections that permute the alphabet or map the alphabet to $n$-digit numbers. We also explore other codomains, such as Morse Code sequences or the target model’s tokenizer vocab.
- 2.
Fixed size: the number of fixed points, i.e. characters that map to themselves, in the mapping. We sample a bijection with fixed size $F$ by randomly selecting $F$ unique characters to be fixed points and randomly assigning the remaining $26-F$ characters to unique elements of the codomain. $F$ is our most fine-trained control for the complexity of the bijection language. Larger values of $F$ are useful for jailbreaking less capable models, while smaller values of $F$ are useful for more capable models that can learn and reason about novel languages on-the-fly.
- 3.
Teaching examples: the number of translation message pairs in step 2 of our attack prompt.

## 3 Jailbreaking Frontier Models

In this section, we demonstrate that bijection learning readily discovers jailbreaks against frontier models across a wide range of harmful categories.

### 3.1 Background and setup

We measure the attack success rate (ASR), or the rate at which our attacks cause language models to provide relevant and helpful responses to harmful requests across a wide range of harm categories. Let LLM be the target model, let $J(\cdot)$ denote a jailbreak mechanism that takes an intent $x$ and returns a jailbreak prompt $J(x)$, and let JUDGE denote a judge model that takes a harmful intent $q$ and response $r$ and classifies the response as “safe” or “unsafe.” For a dataset $\mathcal{D}$ of harmful intents

$$ $\texttt{ASR}=\frac{1}{|\mathcal{D}|}\sum_{x\in\mathcal{D}}\mathbb{1}(\texttt{ JUDGE}(x,\texttt{LLM}(J(x)))=\texttt{`unsafe'})$ $$

Across our experiments, $J(\cdot)$ is bijection learning with 10 teaching examples and different choices of bijection codomain and fixed size.(^1^11We find in initial experiments that jailbreak efficacy did not increase with more than 10 teaching examples.) For each attack prompt, we generate a single response with temperature 0 and a maximum response length of 2048 tokens.

Our JUDGE involves using the HarmBench classifier prompt
(Mazeika et al., ) to direct GPT-4o-mini to classify the response’s harmfulness.(^2^22GPT-4o-mini is significantly less likely to refuse judging of harmful content compared to other models.) Since target models may produce typos when writing in a bijection language, we first denoise the responses by asking GPT-4o-mini to correct spelling errors prior to judging. We verify that the denoising call has high agreement with human judgment and does not add content that was absent in the original text.

Our judging is strict. We only count a response as “unsafe” if it is helpful, detailed, and specific. It is not sufficient for a response to begin affirmatively, which is the threshold adopted by some prior work (Zou et al., ).(^3^33Example: consider a response similar to “Sure, I can tell you how to manufacture mustard gas. How can I help you with that?” We consider this a safe response because it lacks detailed and specific harmful content.) Importantly, while it is common practice to place absolute credence in LLM classifications when reporting ASRs (Mazeika et al., ; Souly et al., ), we manually filter responses that our LLM classifier labels “unsafe” for false positives. Our human evaulation reveals a substantial proportion of false positives (see Appendix D), indicating that our ASRs may substantially understate our attacks’ efficacy relative to previous work. Additionally, since we do not check responses labelled “safe” for false negatives, our true ASRs may be higher than reported.

We attack the following frontier models: Claude 3.5 Sonnet, Claude 3 Opus, Claude 3 Haiku, GPT-4o, and GPT-4o-mini. We use the AdvBench-50 Chao et al. () and HarmBench (Mazeika et al., ) datasets consisting of harmful queries.

We generally evaluate bijection learning in a best-of-$n$ fashion: for a specified harmful intent and attack budget $n$, we generate $n$ random mappings, execute the bijection attack for each mapping, and consider an attack successful if at least one attempt resulted in a harmful response. We successfully elicit high ASRs across our models with a small attack budget of $n=6$, and we see continued returns in jailbreak success with larger attack budgets. When considering bijections as universal attacks, however, we only consider $n=1$ attack attempt for all harmful intents.

Figure: Figure 3: ASRs on HarmBench-35 for bijection learning with different fixed sizes and bijection types compared to baseline methods for Claude 3 Haiku (top) and GPT-4o-mini (bottom). Each row: letter, 2-digit, and tokenizer bijections across fixed sizes (left), encoding-based baselines (middle), best ASRs for letter, digit, and Morse code bijections across fixed sizes (right).
Refer to caption: extracted/5895031/images/ASR_HarmBench35.png

### 3.2 Effective, Automated Attacks with Bijection Learning

#### Effect of fixed size and bijection type.

We first explore how the fixed size and bijection type parameters affect attack efficacy for each target model. For fast iteration speed, we use a balanced subset of 35 intents from Harmbench with 5 intents from each risk category that we denote HarmBench-35. Figure 3 shows bijection attacks compared to other black-box automated attacks, including cipher-based attacks (Handa et al., ) and the “Self-Cipher” prompt that encourages the model to use a latent encoding (Yuan et al., ). We evaluate on Claude 3 Haiku and GPT-4o-mini on HarmBench-35 with attack budget $n=6$ and a range of bijection types and fixed sizes.(^4^44For cost-effectiveness, we only perform parameter sweeps on the least expensive frontier models.)

Fixed size has a large smooth effect on attack efficacy. For a given target model and bijection type, a middling range of fixed sizes yields the strongest attack, while fixed sizes too small or large weaken the attack. We contextualize this effect further in §4 by considering the target model’s capabilities.

We primarily focus on bijections that map from letters to other letters or to digits. Digit bijections are more difficult to learn, which causes slightly lower ASRs for Claude 3 Haiku and GPT-4o-mini as these models struggle to respond coherently in bijection language. Other bijection types may also yield potent jailbreaks, including maps from letters to random tokens in the model vocabulary,(^5^55We omit this tokenizer bijection for Claude since its tokenizer is not public.) or from letters to their Morse Code sequences.
These alternative mappings are occasionally competitive with letter and digit bijections, depending on the model.

**Table 1: We report ASRs on the AdvBench-50 subset and on the full HarmBench test set with a suite of frontier models: Claude 3 Sonnet, Claude 3.5 Opus, Claude 3 Haiku, GPT-4o, and GPT-4o-mini. With a more sizeable attack budget and optimal settings of bijection type and fixed size per model, our bijection learning scheme is a state-of-the-art jailbreak on various frontier models.**
| Model | Bijection Type | Fixed size | Attack budget | ASR |
| --- | --- | --- | --- | --- |
| Claude 3.5 Sonnet | digit | 10 | 9 | 94.0% |
| Claude 3 Haiku | letter | 10 | 21 | 92.0% |
| Claude 3 Opus | digit | 10 | 6 | 94.0% |
| GPT-4o-mini | letter | 18 | 47 | 88.0% |
| GPT-4o | letter | 18 | 39 | 66.0% |

#### Attacking strong models.

In Table 1, we report state-of-the-art ASRs on large frontier models, now also including Claude 3.5 Sonnet, Claude 3 Opus, and GPT-4o. We utilize attack budgets up to $n=47$, comparable to PAIR (Chao et al., ) which uses 20 queries per attack and TAP (Mehrotra et al., ) which averages 30 to 40 queries per attack. Even with only $n=20$, bijection learning elicits harmful responses according to our strict evaluation metric from Claude-3.5-Sonnet, a highly safety-trained model, on 86.3% of intents from HarmBench.

Figure: Figure 4: Left: Increasing the attack budget improves ASR. Right: ASRs for selected bijection learning prompts benchmarked against Pliny’s model-specific universal attack.
Refer to caption: extracted/5895031/images/budget_human_judge.png

### 3.3 Bijection Jailbreaks can be Universal

Besides the best-of-$n$ setting, we may also be interested in producing universal attacks, or particular attack templates into which we can directly paste any harmful intent. While previous work Zou et al. () only considered deterministic attack templates to be universal, our best-of-$n$ bijection learning attack is universal if we allow for random attack templates that do not depend on previous attack attempts, which preserves the same ease of use (note that allowing for random attack templates still excludes sequentially optimized prompts like TAP (Mehrotra et al., )). Still, we may be interested in generating an attack that is universal under the more stringent definition that requires an attack template to be deterministic.

We search for universal attack mapping candidates from our earlier evaluations by selecting attacks which produce a strong response for a particularly malicious intent. For a selected mapping, we generate the fixed bijection learning prompt and evaluate it as a universal attack on HarmBench. In Figure 4, we show the resulting ASRs, compared against universal attacks from Pliny (the Prompter, ). Our universal bijection learning attacks are competitive with Pliny’s attacks, obtaining comparable or better ASRs on frontier models such as Claude 3.5 Sonnet and Claude 3 Haiku. Notably, other universal white-box attack methods (Zou et al., ; Geisler et al., ) fail to transfer to the newest and most robust set of frontier models, so we omit them from this study.

## 4 Bijection Attacks are Stronger with Scale

So far, bijection learning has proven highly effective as a automated and even universal attack vector. In our jailbreaks desiderata (§2.1), we also argued for the importance of designing attacks that are scale-agnostic, or effective against models of varying scales and capabilities.

In this section, we evaluate bijection learning as a scale-agnostic attack, and we uncover an intriguing property of bijection learning—its attack efficacy increases with model capabilities. Our experiments indicate at least two mechanisms for this phenomenon: smaller models are entirely unable to learn difficult bijections, and all models experience some deterioration of capabilities when operating in bijection languages of any difficulty level.

#### Smaller models fail to learn difficult bijections.

Figure: Figure 5: Bijection learning failure modes across attack attempts for Claude 3 Haiku (top row) and GPT-4o-mini (bottom row). Each column: Harmbench-35 (left) and Advbench-50 (right).
Refer to caption: extracted/5895031/images/failure-modes-harmbench-samples.png

In our experiments in §3.2, setting fixed size too low or too high resulted in an ineffective bijection attack, where ASRs were near-zero. Investigating model responses in these settings reveals several common failure modes:

- 1.
Incoherency. The model outputs jumbled and meaningless text, usually in the form of single phrases or words repeated ad nauseum.
- 2.
Unhelpfulness. The model outputs a terse response with no helpful information, usually regurgitating the input with a generic follow-up (“How can I help with this?”).
- 3.
Canned refusal. The model outputs a common refusal, identifiable by the beginning of the first sentence, which usually reads “I’m sorry, but I can’t” or a similar phrase.

A response outside of these three failure modes indicates either a helpful response to the unsafe intent (i.e. a successful attack) or an idiosyncratic failure mode. Canned refusal indicates that the model’s safety mechanisms are working successfully. On the other hand, incoherency and unhelpfulness are both forms of poor model performance. In particular, consistently incoherent responses on a class of bijection mappings indicates that the model has failed to learn the bijection task.

We classify each failure mode by prompting GPT-4o-mini to determine whether a given (intent, response) pair fits the definition of a given failure mode. We use multiple binary classifications to separately detect canned refusal, incoherency, and unhelpfulness.

Figure: Figure 6: Capabilities degradation under the bijection learning scheme as measured by 10-shot MMLU for various models. Error bars are presented along with each MMLU score. Left-to-right, top-to-bottom: Claude 3.5 Sonnet, Claude 3 Haiku, GPT-4o, and GPT-4o-mini.
Refer to caption: extracted/5895031/images/mmlu/claude3p5_mmlu.png

In Figure 5, we show empirical distributions of our failure modes, along with successful attacks or idiosyncratic failures (labeled “other or none”), for all attack attempts from Figure 3. At the largest fixed sizes, the model is able to learn the bijection language, so incoherent and unhelpful responses are rare, but harmful intents encoded in the bijection language do not successfully bypass the model’s safety mechanisms, resulting in high canned refusal rates. On the other hand, for smaller fixed sizes, the model fails to learn the bijection language, resulting in a marked increase in incoherent responses. In very difficult settings, the model fails to learn the vast majority of bijection mappings.

#### Difficult bijections degrade model capabilities as a whole.

Incoherency and unhelpfulness failures under difficult bijections reflect an overall degradation of model capabilities under bijection learning. We evaluate the capabilities of several models on random subsets of MMLU under various settings of bijection learning. We alter the multiple choice labels [A-D] in each question to be double symbols [!!, @@, ##, $$], respectively, to avoid ambiguity about how to report the correct answer. Like our attack prompts, we use 10 teaching examples, but we also add 10 examples of correct MMLU question-answer pairs in bijection language after the teaching examples to encourage the model to answer correctly.

Our MMLU evaluations are shown in Figure 6. Each model’s performance decreases monotonically as bijection complexity increases, e.g. by lowering fixed size, or, for Claude 3.5 Sonnet, increasing the number of digits in a digit bijection.

#### Model vulnerability increases with capabilities.

Figure: Figure 7: Comparing 10-shot MMLU score against ASR on HarmBench-35 for bijection learning settings across models. A point’s color indicates the target model, while its size reflects the fixed size. We plot a quadratic regression for each model, with a tick indicating peak ASR on each curve.
Refer to caption: extracted/5895031/images/scaling-law.png

In Figure 7, we derive scaling laws for jailbreak efficacy for each model.
We visualize model capabilities and harmful behaviors in tandem, comparing MMLU scores against HarmBench-35 ASRs across a large grid of bijection learning settings.

The behavior of bijection learning at various difficulties can be decomposed into a scaling regime and saturated regime, respectively denoting the increasing and decreasing pieces of the scaling law. In the scaling regime, as bijection learning difficulty transitions from very hard to moderate, model capabilities are partially restored while unsafe responses become more coherent and helpful. In the saturated regime, as bijection learning becomes even easier and bijection language encodings approach English plaintext, jailbreak efficacy decreases and refusals become more common, while model capabilities continue to improve.

Furthermore, the leftmost flat region of the scaling law, where ASR is 0% and MMLU performance is at most random chance ($\sim$25%), corresponds to difficult bijection languages entirely beyond the target model’s capabilities. Bijection language-learning may be an emergent ability (Wei et al., ) where the emergence threshold is even higher than the capability levels of some frontier models.

#### A sweet spot for bijection learning.

Between the scaling and saturated regimes is a “sweet spot” setting where bijection attack ASR is the highest (see markers in Figure 7). Interestingly, across target models, higher capabilities at the sweet spot coincides with higher ASR. Hence, the most capable model under bijection learning—Claude 3.5 Sonnet, according to our MMLU evaluations—is also the most susceptible to our attack. Moreover, not all harmful responses are equal; with higher capabilities, jailbroken responses become more helpful and carry more advanced knowledge and reasoning, leading to greater potential for misuse. Ultimately, more capable models are more vulnerable and more dangerous under the optimal bijection attack.

## 5 Discussion and future work

We now discuss broader insights from our analysis of the bijection learning attack. While bijection learning is a highly specific jailbreak scheme, our findings signal that (i) frontier models with greater capabilities will encounter new and greater vulnerabilities, and (ii) to build robust AI systems, oversight models may need to be equally as capable as the underlying models themselves.

#### Advanced reasoning is dual-use.

One key mechanism of our bijection attack is that it uses the advanced reasoning capabilities of frontier models against themselves. The bijection encoding is a benign task that instruction-following language models obey, but the complex reasoning required for bijection learning seems to degrade, overload, or bypass the safety mechanisms of these models.

Furthermore, bijection learning may prove increasingly potent for future-capability frontier models. The flat, “pre-emergence” portions of Figure 7’s scaling laws reveal that particularly difficult settings of bijection learning are at or beyond the edge of current models’ abilities. (Even for Claude 3.5 Sonnet, a combination of low fixed size and 4- or 5-digit-number mappings leads to near-random MMLU performance and near-zero ASR.) This poses an issue for model safety at greater scales: we can devise bijections that current models cannot learn, but future models can. Extrapolating from our analysis, bijection learning attacks may potentially grow even stronger at scales beyond this paper. It remains to be seen whether other scale-agnostic attacks, or other attacks that exploit advanced reasoning capabilities, also become stronger with scale; in any case, future model developers will need to mitigate capabilities-induced vulnerabilities before they can deploy models safely.

To reframe this idea, advanced reasoning capabilities are dual-use. The most advanced language models are capable of complex reasoning in arbitrary settings, making them highly useful for difficult or out-of-distribution tasks. However, these reasoning capabilities can be dually exploited by attacks that can elicit especially dangerous responses for harmful intents.

#### System-level defenses.

Wei et al. () argue that model developers should ensure “safety-capability parity,” where a model’s safety mechanisms should be just as robust as its capabilities are advanced. Our analysis shows that intrinsic safety-capability parity is insufficient, since some attacks can degrade safety and capabilities together in order to jailbreak models. However, it may be effective to defend the generating model using other models at parity with the generating model. We anticipate that an LLM-based output filter, of equal or higher capabilities and safety compared to the generating model, can successfully detect harmful content in bijection language given the full ICL context.
We leave this potential defense up to further experimentation.

Note that adding this output filter would double inference cost for a given model system. The potential necessity of this strong filtering, or similar system-level defenses, highlights that the classical robustness-performance tradeoff in machine learning persists for frontier models. Improving robustness without sacrificing performance remains a challenging research direction in adversarial ML.

## 6 Conclusion

In this work, we red-team frontier language models using a novel bijection learning scheme with several powerful properties. Our
endless attacks are automated, can be used in a universal manner, are scale-agnostic, and become more potent on models with greater capabilities. Our bijection attack is a case study for a potentially broader category of attacks which exploit the advanced reasoning capabilities of state-of-the-art language models. As frontier models keep scaling, it is imperative that model developers consider advanced capabilities as a vulnerability in and of itself when developing safety measures. In addition, a better understanding of scale-agnostic attacks, driven by red-teaming efforts to discover more attacks that become stronger with scale, is essential for understanding the interplay between model capabilities and vulnerabilities.

## Acknowledgements

We are grateful for discussions with Jesse Mu, Mrinank Sharma, Meg Tong, Ethan Perez, and the rest of the wonderful Anthropic Adversarial Robustness team. We thank OpenAI’s Researcher Access Program and Lama Ahmad for facilitating access to OpenAI API credits. We thank Aaditya Singh for feedback regarding scaling laws for model safety, as well as Ben Thompson and Mike Sklar of Confirm Labs for great discussion. Finally, we are deeply indebted to Andriy Mulyar and Brandon Duderstadt of Nomic AI for ideal working conditions and banter.

## Limitations.

Due to cost constraints, we run evaluations on a limited number of closed source models, and we limit larger sweeps and prompt optimization processes only to cheaper models. In addition, model evaluation using bijection learning is moderately costly due to the high number of input tokens spent on in-context examples; a bijection learning prompt with 10 teaching examples produces in the ballpark of 25,000 to 50,000 input tokens. As such, the bijection learning attack in its current form is only valid on models with large context windows. It remains to be seen whether bijection learning jailbreaks can be achieved zero-shot, with fewer input tokens, on open-source models finetuned on bijection language learning examples. In addition, our experiments give limited insight into other possible jailbreak settings, such as non-English language settings or attacks on open-source models incorporating white-box information.

Our research hints at broader arguments about scale-agnostic attacks and attacks that exploit frontier capabilities, but solely through the case study of bijection learning. Further research remains for generalizing the principles of bijection learning into a wider variety of jailbreaking schemes in the context of red-teaming.

## Ethics statement.

By red-teaming language models into exhibiting harmful behaviors, our research is adjacent to many potential misuse cases for current AI systems. Prior to publication, we followed responsible disclosure practices by informing the relevant model creators and AI safety teams about our findings.

Transparency is paramount in AI safety research, and we describe our methods in fine detail to maximize the reproducibility of our work. Additionally, in the Appendix, we share actual model responses that our attack obtains, including some severe ones. Our goal is to provide exact insights into current models’ capacity for harm in worst-case scenarios, especially when such current harms do not exceed what bad actors can do standalone. At this stage, we believe such hands-on knowledge of current harms is beneficial for advancing model safety and red-teaming efforts.

## Appendix A Bijection Learning Prompt Template

We explicitly provide samples of our bijection learning prompt here. A bijection learning prompt template consists of the system instruction (Appendix A.1) followed by $k_{t}$ turns of teaching examples (Appendix A.2) followed by $k_{p}$ turns of practice examples (Appendix A.3). Any harmful instruction can be encoded with the given mapping and appended in a User message to this template. Our teaching examples are taken from Paul Graham essay excerpts, and our practice examples are taken from an extensive multi-turn conversation one of the authors had with Claude 3.5 Sonnet.

### A.1 System instruction

### A.2 Teaching Example

### A.3 Practice Example

## Appendix B Prompts for failure mode classifiers

Recall that in Section §4, we use prompted GPT-4o-mini classifiers to detect failure modes across our attack attempts. We provide our classification prompts here. To detect if a response is a canned refusal, we check if the response is prefixed by any instance from a list of refusal strings that we catalog across GPT and Claude models. As such, our canned refusal detection does not use a prompted LLM classifier; only the incoherency and unhelpfulness failure modes do.

### B.1 Incoherent responses

### B.2 Unhelpful responses

## Appendix C Attacking a model system that has filters

Input and output classifiers for content moderation are a commonly deployed line of defense against jailbreaks in model systems. In our main paper experiments, we attack API models, where the nature of input and output filtering, or whether there is filtering at all, is unclear. In this appendix section, we red-team a more robust model system consisting of a generating model (via API), an input filter, and an output filter.

We employ the LlamaGuard (Inan et al., ) prompt template with GPT-4o-mini calls for each filter layer. For both the input and output filter, we perform safety classification on the entire conversation history so far—i.e., the input filter ingests the bijection learning multi-turn prompt and encoded harmful intent, and the output filter ingests the bijection learning prompt, harmful intent, and model response. If either filter is triggered, our model system exits with a canned refusal.

We run the bijection learning best-of-n attack on a model system that comprises Claude 3.5 Sonnet calls wrapped with our input and output filter. We use the same settings as in the Claude 3.5 Sonnet run from Table 1, using an attack budget of 6. We classify failure modes along with filtering in Figure 8. In total, only 9.5% of total attack attempts trigger one of our filters, and the ASR on HarmBench, measured with only the LLM-as-a-judge, is still very high. Ultimately, our model system with filters is not robust against the vast majority of bijection learning jailbreaks.

Figure: Figure 8: Results for a bijection learning attack using the previous strongest setting for Claude 3.5 Sonnet, this time adding input and output filters surrounding the Claude 3.5 Sonnet calls.
Refer to caption: extracted/5895031/appendix/images/input-output-filter.png

## Appendix D ASRs without human filtering

Recall that, in our evaluations, we follow up our automated LLM-based judging by manually filtering out false positives. Following other research in the redteaming literature which relies purely on LLM-as-a-judge evaluation, we report alternate versions of our results in Table 1 and Figure 4, this time using only the LLM-as-a-judge. Note that, because we only perform manual filtering of false positives and not false negatives, our ASRs without manual filtering will be higher than ASRs with manual filtering, and may overstate jailbreak efficacy compared to average human judgment.

Advbench-50, LLM judge only

| Model | Bijection type | Fixed points | Attack budget | ASR |
| --- | --- | --- | --- | --- |
| Claude 3 Haiku | letter | 10 | 21 | 92.0% |
| Claude 3 Opus | digit | 10 | 6 | 94.0% |
| Claude 3.5 Sonnet | digit | 10 | 9 | 94.0% |
| GPT-4o-mini | letter | 18 | 47 | 88.0% |
| GPT-4o | letter | 18 | 39 | 66.0% |

Harmbench test set, LLM judge only

| Model | Bijection type | Fixed points | Attack budget | ASR |
| --- | --- | --- | --- | --- |
| Claude 3 Haiku | letter | 14 | 6 | 77.8% |
| Claude 3 Opus | digit | 10 | 6 | 70.9% |
| Claude 3.5 Sonnet | digit | 10 | 6 | 81.2% |
| GPT-4o-mini | letter | 18 | 6 | 62.8% |
| GPT-4o | letter | 14 | 6 | 43.1% |

Figure: Figure 9: Increasing the attack budget improves the ASR for all models. ASR reported from pure LLM-as-a-judge.
Refer to caption: extracted/5895031/appendix/images/budget_litellm_judge.png

## Appendix E ASR breakdown by risk category – Claude 3.5 Sonnet

Figure: Figure 10: Risk category breakdown of the highest-ASR HarmBench runs for each model.
Refer to caption: extracted/5895031/images/risk-categories.png

In Figure 10, a breakdown of jailbreak efficacy per HarmBench risk category reveals that frontier models under the bijection learning attack are most vulnerable to misuse for illegal activity, cybercrime, and chemical/biological hazards. Qualitatively, we find that harmful responses from Claude 3.5 Sonnet under bijection learning are particularly egregious. The efficacy of our attack for dangerous capabilities-related risk types highlights the urgency of mitigating model behavior in these risk categories.

## Peer Reviews

confidence: 4
contribution: 2
initial_rating: 6
presentation: 3
questions: 1. "We search for universal attack mapping candidates from our earlier evaluations by selecting attacks which produce a strong response for a particularly malicious intent. For a selected mapping, we generate the fixed bijection learning prompt and evaluate it as a universal attack on HarmBench" (quote starting from line 342). I was confused by this phrasing, is the scaling plot in Figure 4 for best-of-n at n=1 done for a single random sample of a language, or is it done for the single best language subselected from all the prior experiments?
soundness: 3
strengths: 1. The algorithm is clear, simple, and admits random sampling for endless bijections. 
2. The analysis is comprehensive. I really appreciated the scaling analyses for 1) the n in best-of-n and 2) the ASR vs model capabilities frontier showing that more capable models may be more susceptible.
summary: The paper discusses an approach to jailbreaking via bijection learning. Specifically, they generate a random transformation over characters that shifts the input prompt out of the safety fine-tuning distribution. They find that models prompted to answer inputs in bijection format are more likely to output harmful content compared to standard model inference.
weaknesses: 1. The main ideas presented in this paper have been identified in prior works under mismatched generalization [1] and lack of robustness to out-of-fine-tuning distribution prompts such as low-resource languages [2,3]. [1] also makes the observation that transformation-based jailbreaks benefit from increasing model scale. As such, this paper extends these ideas rather than introduces them. 
2. I believe the comparison in Figure 3 to the baselines is not apples-to-apples since bijection learning performs a best-of-6 while the baselines are effectively best-of-1. I think a more fair comparison is either doing best-of-1, or having a combined baseline that's an ensemble of six reasonable baselines.

[1] https://arxiv.org/abs/2307.02483
[2] https://arxiv.org/abs/2310.02446
[3] https://arxiv.org/abs/2309.10105

---

confidence: 4
contribution: 2
initial_rating: 3
presentation: 3
questions: Please see the weakness part above. Could the authors explain more on how their proposed methods differ from the existing ones?
soundness: 2
strengths: 1. ASR of the proposed method is high on many frontier LLMs.
2. The authors did comprehensive experiments to verify the effectiveness of their method. The results reported in Section 3.3 is interesting.
summary: This paper proposes a general framework for jailbreaking attacks with bijection encoding ciphers. Experiments show that the attack is effective on a wide range of frontier language models. They also find out that the bijection cipher attack is more effective on larger and stronger language models.
weaknesses: 1. The novelty of this work is questionable given many existing cipher based jailbreaking attacks. It seems the only difference between this paper and existing works is that this paper proposes to use a system message to customize general cipher encodings. I'm not confident about whether the contributions are enough for ICLR.
2. Comparisons between many other cipher-based jailbreaking attacks are missing, including but not limited to:
[1] When “Competency” in Reasoning Opens the Door to Vulnerability: Jailbreaking LLMs via Novel Complex Ciphers
[2] Jailbreaking Large Language Models Against Moderation Guardrails via Cipher Characters

---

confidence: 3
contribution: 2
initial_rating: 5
presentation: 3
questions: It would be good to see additional discussion on how LLM developers might defend against this style of attack.
soundness: 3
strengths: The authors present an interesting attack that demonstrates the surprising ability to scale with LLM power: stronger LLMs appear more susceptible to this attack. Moreover, the proposed attack achieves key desiderata of jailbreaks: against a black-box target, universal/automatable, and scalable. These qualities make "bijection attacks" a valuable benchmark for LLM developers to consider when evaluating safety.
summary: This paper proposes a new method for jailbreaking LLMs by means of communicating in an encrypted format.
The LLM is first given a simple encryption algorithm for encrypting and decrypting strings.
Then, the user and LLM communicate for several rounds in this encrypted format.
After some time, the user will ask a malicious query (e.g., "Design a weapon") in this encrypted format; this paper finds that the LLM response, when decrypted, is often a jailbroken one.
This style of attack, dubbed a "bijection attack", is more successful against stronger LLMs.
weaknesses: In my opinion, this paper does not have clear weaknesses. However, given the state of jailbreaking research, I do not think that this style of attack paper is scientifically or technically exciting. To change my opinion, I would like to see some deeper technical insights + experiments, possibly with the authors' proposed defense strategies in Section 5 --- but this may be unreasonably ambitious in the rebuttal time frame. While my impression leans on the negative side, I am okay with accepting this work if the other reviewers do not have strong objections.

---

confidence: 4
contribution: 3
initial_rating: 8
presentation: 3
questions: Most of my questions are in the weaknesses section, but here are some other questions/discussion points.

- What does “endless” mean? How is it different from any “adaptive” attack (like PAIR or random search suffixes) that will craft many potential jailbreaks until it finds one that works? I’m not sure emphasising this makes sense. Maybe you reframe it as an “Adaptive in context learning attack”?
- In the abstract, what does universal mean? Is it transferred across harmful requests or across models? Do you have a % of how the same bijection template transfers across requests and across models?
- Multi-turn conversation history - do you think it would be best to use the term few-shot learning here and then, in methodology, talk about how many shots you use (it looks like it is 10-shot?). Also, you call it “teaching examples” later. I would use few-shot since it is clear what it means.
- What defenses work / don’t work against your attack?
- Intro: I wouldn’t describe perplexity filtering, paraphrasing, etc as an alignment technique like RLHF. I’d describe it as an adversarial defense against jailbreaks.
- Maybe add the GPT-4o rewriter to correct typos in Figure 1, so it is clear how it works without needing to read the paper.

This paper has the potential for a much higher rating, but not in its current form. I would happily raise my score if the claims I mention in the weaknesses section are better explained and the results are significantly simplified in the figures and presented well. In addition, I’d like to see the comparison to adaptive black-box attack baselines like PAIR with a comparable attack budget.
soundness: 3
strengths: - **Simple and scalable attack that exploits in-context learning in LLMs**: The bijection learning attack method, allows you to sample a large number of text mappings that transform the input text into a bijection language. This allows you to sample them until you find a successful attack, which is a powerful red-teaming scheme.
- **High ASR on frontier models**: The attack achieves an ASR of 94% on Claude 3 Opus, which is impressive.
- **In-depth analysis of how effective the attack is with different scales**: The authors find that the attacks are stronger with scale. Smaller models fail to learn bijections, but the attack can be tuned for difficulty by changing the “fixed size” to work on less capable LLMs.
- **Contributions to Safety Research**: The paper identifies a new risk factor in AI safety that scales with model capabilities, emphasising the dual-use nature of advanced reasoning in LLMs. It underscores the necessity for evolving safety mechanisms that match these capabilities, providing crucial insights for AI developers on robust mitigation strategies.
summary: This paper introduces an adversarial attack called "bijection learning" that exploits the in-context capabilities of large language models (LLMs) by teaching it a simple cipher to bypass safety guardrails. By teaching LLMs an arbitrary string-string mapping, the attack encodes harmful queries in a "bijection language" which can easily be decoded back to English. The approach is effective across various models, with the attack's potency increasing with model capabilities. The authors demonstrate this with extensive experiments, showing high Attack Success Rates (ASR) on a range of safety-trained frontier models such as Claude and GPT-4o. The paper argues that as models become more capable, they become more susceptible to cipher attacks like bijection learning, posing significant safety challenges.
weaknesses: - **Claims need to be better explained or backed up with a citation:**
    - “Scale of models and safety is under explored”. I’m not sure this is true because most jailbreak attack papers text over various scales. MSJ, Jailbroken, etc, all look at this (or they at least look at how safety changes with scale). You need to make this claim more specific because I agree that using the improved capability to attack via ciphers is underexplored.
    - “Model capability increasing also widens the attack surface”. I think this is unclear. It does introduce new novel vulnerabilities, but it could also be the case that the total attack surface shrinks even when there are these new cipher-based vulnerabilities. So again, I would make this claim more specific and less general (unless you have data to back it up or can cite a paper that does show this generally).
    - Is your method for jailbreaking novel? Ciphers are not new, but perhaps your version of bijection learning in context is novel. I think it is worth being clearer on what is novel and also doing a better job at comparing and contrasting in the related work section.
    - Is the approach scale agnostic? Perhaps to a certain point but this would break down? What is the smallest LLM you tried the approach on? You say “new language model risk factors may emerge with scale” but also say the approach is “scale agnostic”. I think making the story clearer and not mixing the two here would be good. Also, it is important not to confuse bigger models with improved alignment fine-tuning, and it can be tricky to make claims about this since labs do not release details of their training.
    - “while many other jailbreak methods only work on smaller models” - can you cite this or explain more? Most jailbreak techniques, e.g., GCG, PAIR, TAP, etc, work well across all model sizes, so I am not sure this claim is true.
    - “more powerful on more capable models” - can you quantify this?
    - “arguable the safest frontier model at time of writing” - can you cite this result or remove it? Gemini 1.5 Pro is very competitive and I’m not sure which is ultimately better.
    - “endless mappings that yield successful jailbreaks” - how many templates did you test, and how many of them worked? It would be good to quantify this in your contributions.
    - “certain complexities of bijection learning systematically produce certain failure models, giving further insight into our scaling laws” - what is the complexity of bijection learning? What are the failure modes? Can you give a one-sentence summary to help ground this claim?
    - “more severe harmful behaviors more frequently” - how much more? Can you give an idea of the jump from 3.5-level models to 4? How do you know that it is bijection learning that induces more harmful behaviour? It could simply be because the model is more capable. Perhaps compare “egregiousness” with other jailbreaks and see if bijection learning induces more harmful ones. Otherwise, this claim isn’t interesting.
    - Say more about your scaling laws in the contribution section - do they allow you to forecast future capabilities? What equation are you fitting?
    - “harmful model responses produced by our attack are thus fully reproducible” - have you tested this on all frontier models? Even at temp 0, output diversity exists, so be careful of your claim here.
    - “Our work is the first to produce attacks that are simultaneously black-box, automated, and scale agnostic” - I don’t think this is the case. PAIR and TAP are prime examples of methods that fit these criteria.
    - In the results section: “[whitebox methods] fail to transfer to the newest” - could you cite this? There is some GCG transfer. If you have numbers, then include them in the paper (even if it is in the Appendix)
- **Some discussion points can be improved:**
    - I think you can motivate your work better e.g. many attacks are caught by defenses such as output classifiers, but your work can bypass these easily by using a cipher that the output classifier won’t understand. However, it is unclear if you use an input+output classifier if they will catch your attacks or not. The classifier must be at the same capability level as the generation model.
    - The discussion of the “bijection jailbreaks can be universal” can be improved by making the point that the algorithm itself leads to a universal attack and relies on a “fuzzing” technique that samples a prompt template until one works. See LLM fuzzer paper https://www.usenix.org/conference/usenixsecurity24/presentation/yu-jiahao.
- **Related work lacks comparing and contrasting with their work:**
    - Safety of LLMs - this does not compare and contrast with your work. Is it even relevant
    - Adversarial attacks against LLMs - please compare and contrast more. Maybe separate the cipher work into its own section and contrast it in more fine-grain detail.
    - Adversarial robustness in LLMs - is this relevant to your work since you don’t look into defenses?
- **Lack of threat model:** Why are you working on black-box attacks on frontier models? Why is this more impactful to work on than white-box attacks? (I think it is)
- **Improving method explanation**:
    - Desiderata section. Universal and/or automated - this sentence is hard to parse, perhaps separate into two bullets
    - Fixed size (section 2.2) - this bullet point makes it hard to understand what you mean. It is a simple concept, and I think it could be explained more clearly and with fewer words. I think it would be easier to define complexity, C, as the number of characters that map to something else. Then it is easy to understand that C=0 means there is no change, and C=26 means you change each letter for something else.
    - The false positive rate is not measured. Report the false positive rate when you talk about it. Also, do you check every single response in all your experiments? Some more clarity on your method here (including a rubric your human evaluators follow) would be good as it impacts the ASRs throughout the paper a lot and will help people replicate.
    - Add how you filter HarmBench, e.g. do you just use standard direct requests and remove copyright/context ones?
- **Lack of black-box baselines and explanation of baselines used**:
    - There should be more baselines, e.g. vs PAIR and TAP. You could evaluate these with the BoN methodology too. I expect PAIR to get similar ASRs on GPT4o-mini. Without these, it makes
    - Please explain your implementation for ascii, caeser-cipher, morse code and self-cipher. (I suggest significantly cutting down section 5 to make room). The reader is left guessing how these work. Is it fair to compare them when you have a different attack budget for bijection learning?
- **The presentation of results is poor as the figures are too small and contain too much data.** In general, I’d recommend thinking about the main insight you want the reader to take away from each figure and majorly simplifying it so that is the case.
    - Figure 3 - this is a little messy. Why do we need the tables on the right when the bar charts have all the details? I think it would be great to have a bar chart with the best-fixed size for each bijection type and compare directly against baselines for each model (using the full 320 behaviors since HarmBench-35 isn’t large enough). Then, a separate figure that ablates the fixed size. Then, it makes it easy to highlight the insights you’d like to convey in the caption and main text. What is the attack budget for these?
    - I think Table 1 contains the exciting results. I’d suggest leading with this before Figure 3. I’d also like to see comparable PAIR or TAP ASRs on the HarmBench 320 and AdvBench 50 set in the table. I think it is less important to show the fixed size and attack budget and just show the ASRs vs the baselines. Also, maybe fix the attack budget to the same as the budget for PAIR so it is more directly comparable. Also, how did you choose the current attack budgets? Was that the plateau point?
    - Figure 4 left - This is an awesome plot, and I think you should make a bigger deal out of it.
    - Figure 5 - I think this could be better as a line plot. Perhaps choose to plot either ‘digit’ or ‘letter’ rather than both to simplify. Share legend for all. Also, I think just having three lines: successful attack, refusal, and unhelpful non refusal would help simplify this. Potentially, just plotting unhelpful non-refusal for each model would get your point that smaller models can’t learn complexity bijections the best.
    - Figure 6 - share the legend so each plot is bigger. The main point you are trying to make is that the capability degrades as fixed size increases, but this message is easily lost with the amount of information you present. I’d recommend simplifying - just show it averaged over models and maybe drop some of the multi-digit results. You can put this plot in the appendix to refer to some nitty gritty details.
    - Figure 7 - I don’t think this is a scaling law. It is more of a Pareto frontier plot where you want to show the trade-off in two metrics. A scaling law would involve the amount of computing, data size, or size of the model. Did you experiment with different fits? A quadratic might not be as good as a higher-order polynomial. Why is a quadratic the right fit for this data?
    - General plotting advice: Please use error bars for all plots that take into account the sample size used (this can just be a standard error of a proportion that doesn’t involve rerunning many seeds). Use a colour-blind pallet, and make the font in figures a similar size as the font of paper.

Meta-review: The paper proposes a novel bijection method leveraging side-channel techniques to jailbreak large language models (LLMs). The findings indicate that stronger LLMs are more vulnerable to jailbreak attacks and demonstrate state-of-the-art (SOTA) attack success rates. The proposed method also achieves high success rates in jailbreaking Claude, a leading LLM. These claims are supported by experimental results and comparisons to baseline attack techniques.

The strengths of the paper include its highly effective method for jailbreaking LLMs, which outperforms existing approaches in terms of success rate. The methodology is rigorously evaluated, demonstrating robustness across multiple LLMs, including Claude. This highlights the practical implications and potential risks of deploying strong LLMs in sensitive environments. The paper also finds that that stronger models are easier to jailbreak.

The weaknesses of the paper lie in its lack of novelty and limited scientific contribution to advancing the understanding of LLM vulnerabilities. While the bijection method is effective, the finding does not offer new insights into the fundamental mechanisms underlying these vulnerabilities. This paper would be useful if this capacity degradation argument was real and substantiated. Unfortunately, in the current state, their argument does not seem fully convincing

The primary reason for accepting the paper shall be its empirical results, which stands out as one of the better jailbreak papers. However, there would also be reasons to reject this paper due to its insufficient contribution to advancing scientific understanding. While the method demonstrates strong empirical results, the findings do not significantly enrich the field's knowledge or provide actionable recommendations for addressing the security challenges posed by jailbreaking attacks.

Decision: Accept (Poster)