Title: LARGO: Latent Adversarial Reflection through Gradient Optimization for Jailbreaking LLMs
Venue: NeurIPS 2025
Accepted: yes
Keywords: Jailbreak

LLM
Abstract: Efficient red-teaming method to uncover vulnerabilities in Large Language Models (LLMs) is crucial. While recent attacks often use LLMs as optimizers, the discrete language space make gradient-based methods struggle. We introduce LARGO (Latent Adversarial Reflection through Gradient Optimization), a novel latent self-reflection attack that reasserts the power of gradient-based optimization for generating fluent jailbreaking prompts. By operating within the LLM's continuous latent space, LARGO first optimizes an adversarial latent vector and then recursively call the same LLM to decode the latent into natural language. This methodology yields a fast, effective, and transferable attack that produces fluent and stealthy prompts. On standard benchmarks like AdvBench and JailbreakBench,  LARGO surpasses leading jailbreaking techniques, including AutoDAN, by 44 points in attack success rate. Our findings demonstrate a potent alternative to agentic LLM prompting, highlighting the efficacy of interpreting and attacking LLM internals through gradient optimization.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nSummary:\n\nLLMs are well known to be vulnerable to jailbreaks, prompt injections, and adversarial attacks generated using gradient-based-attacks (e.g. GCG). However jailbreaks and prompt injections tend to be hand-curated by manual prompters. Recent work, e.g. Scale/MHJ has shown a durable between the strongest human written jailbreaks and automated methods in the multi-turn context, and the ongoing discovery of new red-teaming tactics by human jail-breakers bears this out.\n\nStrong automatic jailbreaking strategies are critical to \na) Understand how vulnerable existing LLMs are to these attacks so as  to inform deploy/no-deploy decisions \nb) Generating accurate synthetic jailbreak data for training guard models and adversarial training\nc) Helping researchers generate more robust pre/post-training approaches.\n\nThe strongest gradient based jailbreak method has been the GCG attack, but this attack is very inefficient in terms of forward passes.\nInformally, GCG is intermediate between random search and true gradient based optimization. This is because the gradients are computed in the continuous space of the model but need to be rounded/converted to the discrete token space. Getting around this discrete to continuous rounding problem has been a going challenge in gradient based optimization of text jailbreaks. \n\nThe Algorithm is very  simple:\n\n1. Attack the model in the soft-embedding space, i.e. soft tokens, using the GCG loss\n2. Round the soft-token attack to hard tokens using this prompt to the attack LLM User: Assistant: Sure, I will summarize the message:\nLine 94.\n3. If the hard-token attack is not adversarial, KEEP going until a set number of iterations is complete. \n\nThe authors also conduct transfer experiments, compute perplexity, and compute universal suffixes.\n\nThe score jailbreaks using the legacy keyword matching from the original Zou/GCG paper and the more accurate StrongReject paper from Neurips 2024.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\nFull Disclosure: I have been working on a very similar research direction, so obviously I think this paper is a valuable contribution! \n\n0. My summary above explains why I think designing strong and efficient gradient based jailbreaking attacks is important. I am optimistic this line of research will helps us design better post-training architectures, do robust training, and train defensive models. Also, could be used for economically efficient automated red teaming as a proxy for human attackers.\n\n1. I think the formal/benchmark results are somewhat secondarily to the “it ain’t dumb if it works”. The main value of this paper is this simple and novel way to conduct the soft-to-hard rounding in a way that has non-trivial ASR on meaningful models!\n\n2. Because the ability of LLMs to generate fluent text, the LARGO attacks generate substantially lower perplexity attacks than GCG. The authors do cite another recent paper, ADVprompter, which has lower perplexity, but also lower ASR (attack suggest rate) suggest an ASR-PPL tradeoff. \n\nThe  low perplexity, diverse jailbeaks, generated automatically, are one of the strongest features of this paper.\n\nWeaknesses:\n\n-the authors primarily benchmark against an older model, Llama 2-7B. A strength of the original GCG paper was that the authors had results for the frontier models of the time, gpt 3.5.\n\nThe authors must report if they did conduct experiments attacking larger/frontier models. If the results are negative, please include them, even informally.  If the authors did not attack models like Claude Sonnet, Deepseek R1, gemini, gpt4.0, or larger llama variants, please explain why? I assume this is because of cost/complexity, which is in my opinion a valid reason and would not change my strong score of this paper. That said, I want an answer!  If an answer is not provided, I may move my score downward.\n\nTo me, the authors convincingly demonstrate strong improvement over GCG other than the lack of these transfer experiments.\n\n-The next weakness is that GCG is very computationally intense. Why don’t the authors report comparisons in compute time for GCG vs their attack? My understanding of the paper makes me think this attack should be substantially faster, maybe even an order of magnitude. Such comparisons could even be in analytical form vs experiments? The authors should meaningfully comment on this. \n\n-There are stronger/more modern gcg variants like nanogcg. the authors do not compare to these stronger baselines or even cite them. please do more literature search and cite these. another such attack came from haize labs, not sure if there is an open source implementation.\n\nQUESTIONS:\nsee above, most of my weaknesses included questions.\n\n-How does the computational complexity of this attack compare to baseline GCG?\n\n-The authors claim to release code, but I do not see it, please clarify.\n\n-The authors must report if they did conduct experiments attacking larger/frontier models with transfer attacks and briefly explain why they did not (e.g. time/cost).\n\nLIMITATIONS:\nI don't think the ethical limitations section is very good. I am a bit disappointed the authors did not grapple with this more meaningfully or more persuasively write my designing novel and stronger jailbreaking strategies is justified despite the potential harm.\n\nAdditionally, the authors seem to not have disclosed this to any frontier labs. I am not 100% sure this disclosure is the correct choice, but the authors should at least have discussed this with each other and in the limitations section. Please expand the ethical review section substantially, this is a glaring weakness in the paper. THIS attack could have serious negative real world impact, please take that more seriously.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 5, "CLARITY": 4, "IMPACT": 4, "ORIGINALITY": 4, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a jailbreak method against LLMs named LARGO. Previous methods (e.g., GCG) optimize adversarial suffixes at the token level but are constrained by discrete optimization challenges. In contrast, LARGO optimizes the suffix in the embedding space and then prompts the LLM to convert the continuous adversarial suffix into a natural-language suffix. LARGO mitigates the inefficiency of gradient-based adversarial prompt generation caused by discrete optimization, as well as the lack of interpretability in adversarial prompts.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:  \n- The idea is interesting, and the paper is clearly organized and well-motivated.  \n- The method is simple yet effective, which is impressive.  \n- The experimental results show that the method is effective.  \n\nWeaknesses:  \nMy concerns are as follows:  \n- Does the interpreted suffix have a similar intermediate representation to the original latent suffix?  \n- In line 94, the \\<latent suffix\\> is detached from the original context in which it was optimized. This separation may cause it to lose its intended functionality, potentially making it hard to be decoded accurately. I believe a proper implementation of this method might require the model to repeat the full request (i.e., \\<harmful request\\> + \\<latent suffix\\>) . E.g.,  \n```bash\nUser: <harmful request> <latent suffix> \\n\\n Please repeat the above request. Assistant: Sure, I will repeat ...\n```  \n- Is iterative refinement truly necessary? Given that the latent suffix alone successfully jailbreaks the model, and the model can interpret the embedding into a discrete textual suffix, wouldn’t a single-round interpretation suffice? Alternatively, might best-of-N sampling provide adequate interpretation without iterative steps?  \n- Since optimization in latent space can already jailbreak the white-box model, it seems unnecessary to compare its effectiveness with other white-box jailbreaking methods. The focus of the paper should be on black-box attacks, rather than devoting extensive discussion to the performance of white-box attacks.  \n- The methods selected for comparison are insufficiently comprehensive; additional relevant approaches should be included and discussed.\n\nQUESTIONS:\nSee Weaknesses\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes LARGO, a novel suffix jailbreak attack. It is implemented by repeatedly searching for continuous jailbreak suffix embeddings and then mapping them back to discrete text, to discover effective \"real jailbreak suffixes\". Experiments on several baseline LLMs and jailbreak datasets show that LARGO achieves superior attack performance and greater jailbreak prompt readability (i.e., lower perplexity) compared with existing attacks.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n\n1. I appreciate the idea of iteratively searching the continuous jailbreak suffix embeddings and then mapping back to discrete text to find an effective real-world jailbreak suffix. This idea is well-motivated and intuitively makes sense.\n\n2. I believe this paper makes a significant contribution in tackling real-world challenges. Performing jailbreak attacks is typically inefficient because attackers usually need to optimize prompts in the discrete token space, which, however, is difficult. The authors propose a practical and novel solution to this problem.\n\n\n**Weaknesses**\n\n1. There are too few baseline jailbreak attacks. The authors include only three baselines, including the outdated GCG attack. I suggest adding more baselines such as BEAST [r1], AmpleGCG [r2], and PAIR [r3], all of which aim to generate low-perplexity jailbreak prompts. Moreover, previous works such as [r4] show that PAIR is more effective than AutoDAN, so I think it is necessary to adopt the PAIR attack as a baseline.\n\n2. To the best of my knowledge, [r5] was the first to perform jailbreak attacks via the token embedding space. Although I know that the proposed LARGO uses continuous embeddings in a way that is very different from [r5], I still suggest that the authors cite [r5] and briefly discuss the differences between these two approaches.\n\n3. What is the jailbreak suffix token length used for the GCG attack? Is it set to the default 20 tokens as in the original GCG paper? If so, the comparison in Table 1 between GCG and the proposed LARGO might not be fair. According to Table 6, it seems that LARGO uses a suffix length of at least 50 tokens. Since longer suffixes may lead to stronger jailbreak attacks, the authors should explain why the comparison between LARGO and GCG (i.e., 50 suffix tokens vs. 20 suffix tokens) in Table 1 is appropriate.\n\n4. There are too few targeted LLMs. The main attack evaluation (i.e., Table 1) is conducted on only three models, two of which are quite old (Llama-2-7B and Llama-2-13B). I suggest including results for Qwen-2.5-14B in Table 1 (just like that in Table 3), and adding newer models such as Llama-3.1, Llama-4, Qwen-3, and Deepseek-V3.\n\n5. I suggest including a comparison of the time usage for performing different jailbreak attacks.\n\n\n**References**\n\n[r1] Sadasivan et al. \"Fast Adversarial Attacks on Language Models In One GPU Minute\". ICML 2024.\n\n[r2] Liao et al. \"AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs\". COLM 2024.\n\n[r3] Chao et al. \"Jailbreaking Black Box Large Language Models in Twenty Queries\". SaTML 2025 (arXiv 2023).\n\n[r4] Xhonneux et al. \"Efficient Adversarial Training in LLMs with Continuous Attacks\". NeurIPS 2024.\n\n[r5] Schwinn et al. \"Soft prompt threats: Attacking safety alignment and unlearning in open-source llms through the embedding space\". NeurIPS 2024.\n\nQUESTIONS:\nSee **Weaknesses**.\n\nLIMITATIONS:\nSee **Weaknesses**.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces LARGO, a three-stage jailbreak framework that optimizes a continuous latent suffix with gradient descent to maximize the probability of an affirmative harmful response. Then it prompts the same LLM to self-reflect and decode that latent vector into a human-readable suffix. Finally, LARGO back-projects the decoded text into the embedding space for further refinement until the attack succeeds.\nExperiments on AdvBench and JailbreakBench show that LARGO attains the highest keyword-based ASR on Llama and Phi-3 while keeping perplexity far below GCG and only modestly above AdvPrompter. Ablations confirm that the optimized latent outperforms random latents and that longer suffixes strengthen attacks.\n\nSTRENGTHS AND WEAKNESSES:\nStrenghts:\n\n1. Direct gradient optimization in embedding space sidesteps the combinatorial explosion of discrete token search.\n\n2. Self-reflective decoding yields benign-looking English paragraphs with perplexity orders of magnitude lower than GCG.\n\n3. The method works in single-prompt, universal, and transfer settings without manual prompt templates or auxiliary attacker models.\n\nWeaknesses:\n\n1. Reliance on self-interpretation may be brittle. Asking the same target LLM to explain its own latent attack vector mixes optimization and decoding responsibilities. This circular dependency could fail on models whose reflection abilities are weaker or deliberately sandboxed —so “letting the LLM explain the latent is not necessarily a robust strategy.”\n\n2. No measurement of latent-only success. The paper does not report how often the raw optimized latent (without decoding) already triggers jailbreak, so the marginal benefit of the self-reflection step is unclear.\n\n3.  The study stops at Llama-2 and Phi-3; it does not test against the newest open-source or frontier systems such as Llama-3, Qwen2.5, or GPT-4o. As a result, it is unclear whether the proposed latent-space attack scales to today’s strongest alignment defenses.\n\n4. While LARGO outperforms GCG, AutoDAN, and AdvPrompter, more recent approaches reach 85-95 % ASR on the same benchmarks, whereas LARGO tops out in the mid-60 % range. The paper does not benchmark against these newer baselines, leaving its relative effectiveness uncertain.\n\nQUESTIONS:\n1. Could you measure attack success when directly appending the optimized latent embeddings (e.g., via embedding API) without converting to text? Quantifying the gap between latent-only and text-decoded ASR would clarify how much the reflection step really adds.\n\n2. Right now the pipeline first optimizes a latent vector and only then decodes it to text. Have you explored fine-tuning the decoded tokens based on the learned latent, or even running a single loop that jointly optimizes both the latent representation and its textual realization?\n\nLIMITATIONS:\n1. White-box dependency. Gradient access is assumed in main experiments;\n\n2. Model self-reflection assumption. Success hinges on the model’s ability (and willingness) to turn latent vectors into sensible language.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-03"}