ICML 2025

Adversarial Reasoning at Jailbreaking Time
Mahdi Sabbaghi 1 Paul Kassianik 2 George Pappas 1 Amin Karbasi 1 Hamed Hassani 1
Abstract
As large language models (LLMs) are becoming
more capable and widespread, the study of their
failure cases is becoming increasingly important.
Recent advances in standardizing, measuring, and
scaling test-time compute suggest new method-
ologies for optimizing models to achieve high per-
formance on hard tasks. In this paper, we apply
these advances to the task of “model jailbreaking”:
eliciting harmful responses from aligned LLMs.
We develop an adversarial reasoning approach to
automatic jailbreaking that leverages a loss signal
to guide the test-time compute, achieving SOTA
attack success rates against many aligned LLMs,
even those that aim to trade inference-time com-
pute for adversarial robustness. Our approach in-
troduces a new paradigm in understanding LLM
vulnerabilities, laying the foundation for the de-
velopment of more robust and trustworthy AI sys-
tems. Code is available at Github.
1. Introduction
Large language models (LLMs) are increasingly deployed
with various safety techniques to ensure alignment with hu-
man values. Common strategies include RLHF (Christiano
et al., 2023; Ouyang et al., 2022), DPO (Rafailov et al.,
2024), and the usage of dedicated guardrail models (Inan
et al., 2023; Rebedea et al., 2023). In nominal use cases,
alignment methods typically refuse to generate objection-
able content, but adversarially designed prompts can bypass
these guardrails. A challenge known as jailbreaking con-
sists of finding prompts that circumvent safety measures
and elicit undesirable behaviors.
Current jailbreaking methods fall into two categories: token-
space and semantic-space attacks.
Token-space attacks
(Shin et al., 2020; Wen et al., 2023; Zou et al., 2023; Hayase
et al., 2024; Andriushchenko et al., 2024a) focus on token-
1University of Pennsylvania 2Robust Intelligence @ Cisco.
Correspondence to: Mahdi Sabagghi ...