Tree of Attacks with Pruning (TAP): Automated Jailbreaking of Black-Box LLMs
Date: 2023-12
Affected: GPT-4 Turbo, GPT-4o, GPT-3.5, Vicuna, Llama-2, LlamaGuard
Attack vector: jailbreak
Category: research
Severity: High

Mehrotra et al. introduce TAP, which uses an attacker LLM and tree-of-thoughts reasoning to branch, prune, and assess candidate jailbreak prompts. TAP jailbreaks GPT-4-Turbo, GPT-4o, and even guardrail-protected models (e.g., LlamaGuard) more than 80 percent of the time.


Mitigations:

Architectural layers (MAESTRO):