Best-of-N Jailbreaking
Date: 2024-12
Affected: GPT-4o, Claude 3.5 Sonnet, Gemini, Llama
Attack vector: jailbreak
Category: research
Severity: High

Hughes et al. introduce Best-of-N, a simple black-box algorithm that repeatedly samples augmented variants of a harmful prompt (capitalization shuffles, character noise, audio/image perturbations) until the target complies. Effective across modalities and frontier models.


Mitigations:

Architectural layers (MAESTRO):