ICML 2025

PANDAS: Improving Many-shot Jailbreaking via
Positive Affirmation, Negative Demonstration, and Adaptive Sampling
Avery Ma 1 Yangchen Pan 2 Amir-massoud Farahmand 3
Abstract
Many-shot jailbreaking circumvents the safety
alignment of LLMs by exploiting their ability
to process long input sequences.
To achieve
this, the malicious target prompt is prefixed with
hundreds of fabricated conversational exchanges
between the user and the model. These exchanges
are randomly sampled from a pool of unsafe
question-answer pairs, making it appear as
though the model has already complied with
harmful instructions. In this paper, we present
PANDAS: a hybrid technique that improves
many-shot jailbreaking by modifying these
fabricated dialogues with Positive Affirmations,
Negative Demonstrations, and an optimized
Adaptive Sampling method tailored to the target
prompt’s topic. We also introduce ManyHarm,
a dataset of harmful question–answer pairs, and
demonstrate through extensive experiments that
PANDAS significantly outperforms baseline
methods in long-context scenarios.
Through
attention analysis, we provide insights into how
long-context vulnerabilities are exploited and
show how PANDAS further improves upon many-
shot jailbreaking. Our source code is available at
https://github.com/averyma/pandas.
Warning: This paper contains model behavior
that can be offensive or harmful in nature.
1. Introduction
The growing length of context windows in large lan-
guage models (LLMs) unlocks applications, such as agentic
LLMs (Park et al., 2023), that were previously impractical
or severely limited (Team et al., 2024; Ding et al., 2024; Jin
et al., 2024; Wu et al., 2024; Dong et al., 2024).
1University of Toronto, Vector Institute 2University of Oxford
3Polytechnique Montr´eal, Mila - Quebec AI Institute, University of
Toronto. Correspondence to: Avery Ma <ama@cs.toronto.edu>.
Proceedings of the 42 nd International Conference on Machine
Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 20...