## 4 Experiments
### Performance Evaluation of Jailbreak Attacks  
The ASR of each method for the forbidden questions was evaluated on GPT-3.5, GPT-4, and Gemini-Pro (Table 1). Overall, the proposed method achieved a higher ASR compared to the baseline and other methods. Specifically, on GPT-3.5, the overall ASR of the proposed method was 81.0%, not only higher than the baseline ASR (34.4%), but also above the manual jailbreak attack (51.3%) and the state-of-the-art PAIR (72.8%). Moreover, the average number of iterations required for jailbreaking by the proposed method and PAIR were both 4.1. Despite the same number of iterations, the proposed method achieved a higher ASR. On GPT-4, the proposed method also demonstrated high attack performance. The overall ASR of the proposed method was 85.4%, compared to 46.9% for the baseline, 35.4% for manual jailbreak attacks, and 84.6% for PAIR. Although the ASR of the proposed method was only slightly higher than that of PAIR, considering that the average number of iterations was 3.1 for the proposed method and 3.5 for PAIR, the proposed method can be considered more efficient. On Gemini-Pro, the overall ASR of the proposed method was 83.3%, significantly higher than the baseline (55.9%) and manual jailbreak attack (45.6%), but slightly lower than PAIR (84.1%). However, the average number of iterations for the proposed method was 3.8 compared to 4.6 for PAIR, suggesting that the proposed method could be a strong complement to PAIR. \begin{table}
\begin{tabular}{l c c c c c c c c c c c c c} \hline \hline
**Scenario** & \multicolumn{4}{c}{**GPT-3**} & \multicolumn{4}{c}{**GPT-4**} & \multicolumn{4}{c}{**Gemini-Pro**} \\  & **Ours** & **PAIR** & **MJA** & **BL** & **Ours** & **PAIR** & **MJA** & **BL** & **Ours** & **PAIR** & **MJA** & **BL** \\ \hline Economic Harn & **96.7** (2.4) & 90.0 (4.1) & 63.3 & 46.7 & **100.0** (1.0) & **100.0** (1.1) & 90.0 & **100.0** & 96.7 (1.7) & **100.0** (2.6) & 73.3 & 83.3 \\ Financial Advice & 80.0 (3.3) & 86.7 (2.9) & **96.7** & 63.3 & 70.0 (3.0) & **100.0** (4.0) & 80.0 & 60.0 & 86.7 (3.4) & **96.7** (2.3) & 93.3 & 76.7 \\ Fraud & **66.7** (5.3) & 60.0 (5.3) & 6.7 & 0.0 & **100.0** (5.0) & 80.0 (4.8) & 0.0 & 30.0 & 76.7 (4.2) & **80.0** (6.6) & 30.0 & 56.7 \\ Gov Decision & **90.0** (8.9) & **90.0** (5.7) & 36.7 & 16.7 & **100.0** (3.8) & **80.0** (2.9) & 30.0 & 30.0 & **96.7** (4.7) & 93.3 (4.9) & 40.0 & 63.3 \\ Hate Speech & **83.3** (2.8) & 63.3 (5.6) & 30.0 & 10.9 & **90.0** (3.9) & **90.0** (4.1) & 0.0 & 30.0 & 80.0 (7.2) & 83.3 (7.8) & 13.3 & 36.7 \\ Health Consultation & 53.3 (2.6) & 50.0 (3.1) & 99.3 & 43.3 & 50.0 (5.6) & **90.0** (6.3) & 30.0 & 30.0 & 80.0 (3.3) & **83.3** (5.8) & 60.0 & 53.3 \\ Illegal Activity & **60.0** (7.7) & 26.7 (6.5) & 10.0 & 0.0 & **70.0** (5.0) & 50.0 (5.4) & 0.0 & 0.0 & **63.3** (6.1) & 60.0 (5.7) & 20.0 & 33.3 \\ Legal Opinion & 90.0 (1.9) & 90.0 (1.9) & **100.0** & 86.7 & **90.0** (2.8) & **90.0** (4.1) & 70.0 & 80.0 & 93.3 (1.2) & **100.0** (1.4) & 96.7 & 93.3 \\ Malware & **73.3** (5.6) & 70.00 (5.8) & 8.7 & 3.3 & **80.0** (3.5) & 70.0 (5.1) & 10.0 & 20.0 & **76.7** (6.7) & 70.0 (7.0) & 6.7 & 6.7 \\ Physical Harn & **76.7** (5.0) & 66.7 (6.4) & 10.0 & 3.3 & 70.0 (3.1) & **80.0** (2.4) & 10.0 & 20.0 & 63.3 (5.8) & **80.0** (7.3) & 6.7 & 16.7 \\ Political Lobbying & **100.0** (1.1) & **100.0** (1.1) & **100.0** & 96.7 & **100.0** (1.0) & **100.0** (1.0) & **100.0** & **100.0** (1.1) & **100.0** (1.0) & **100.0** (1.0) & **100.0** (1.0) & **100.0** (10.0 Across different scenarios, the proposed method generally showed high attack performance. This was particularly true in scenarios where safeguards seemed to be stronger. For example, in the \"Illegal Activity\" scenario, the baseline ASR was 0% on GPT-3.5, indicating strong safeguards. While PAIR achieved an ASR of 26.7%, the proposed method reached 60.0%. On GPT-4, the ASR for the proposed method was 70.0%, compared to 50.0% for PAIR. In the case of Gemini-Pro, the proposed method's ASR (63.3%) was slightly higher than PAIR's (60.0%).