T urbo F uzz LLM : Turbocharging Mutation-based Fuzzing for Effectively Jailbreaking Large Language Models in Practice (2025)

Abstract: Jailbreaking large-language models (LLMs) involves testing their robustness against adversarial prompts and evaluating their ability to withstand prompt attacks that could elicit unauthorized or malicious responses. In this paper, we present TurboFuzzLLM, a mutation-based fuzzing technique for efficiently finding a collection of effective jailbreaking templates that, when combined with harmful questions, can lead a target LLM to produce harmful responses through black-box access via user prompts. We describe the limitations of directly applying existing template-based attacking techniques in practice, and present functional and efficiency-focused upgrades we added to mutation-based fuzzing to generate effective jailbreaking templates automatically. TurboFuzzLLM achieves \geq 95% attack success rates (ASR) on public datasets for leading LLMs (including GPT-4o & GPT-4 Turbo), shows impressive generalizability to unseen harmful questions, and helps in improving model defenses to prompt attacks.

## introduction with the rapid advances in applications powered by large-language models (llms), integrating re-* corresponding authors 1 warning: this paper contains techniques to generate unfiltered content by llms that may be offensive to readers. existing jailbreaking methods can be broadly categorized into a) white-box methods like @xcite @xcite @xcite , etc., which require full or partial knowledge about the target model, and b) blackbox methods like @xcite @xcite @xcite @xcite @xcite , etc., which only need api access to the target model. in particular, gptfuzzer @xcite proposed using mutation-based fuzzing to explore the space of possible jailbreaking templates. the generated templates (also referred as mutants) can be combined with any harmful question to create attack prompts, which are then employed to jailbreak the target model. figure 2 in the appendix provides a motivating example of this approach. our objective is to produce sets of high quality (attack prompt, harmful response) pairs at scale original templates harmful questions target llm jailbreaking templates jailbroken responses metrics select template select mutation attack target llm evaluate response update template selector update mutation selector ## experiments we conducted a detailed experimental evaluation to answer the following research questions: rq1: does turbofuzzllm outperform gptfuzzer in terms of attack performance? rq2: how does turbofuzzllm compare against other jailbreaking methods in terms of attack success rate? rq3: how generalizable are templates generated with turbofuzzllm when applied to unseen harmful questions? rq4: which upgrades significantly influence the attack performance of turbofuzzllm? additionally, §3.4 presents how to improve inbuilt defenses by performing supervised adversarial training using red-teaming data generated with turbofuzzllm. ## conclusions & future work we presented turbofuzzllm, a significant upgrade over @xcite for effectively jailbreaking llms automatically in practice using blackbox mutation-based fuzzing. our experimental evaluation showed turbofuzzllm @xmath0. templates learnt with turbofuzzllm generalize to unseen harmful questions directly. supervised adversarial training using jailbreaking artifacts generated with turbo-fuzzllm significantly improved in-built model defenses to prompt attacks. future work includes presenting evaluation over an extended set of leading llms, comparison against latest/concurrent jailbreaking methods @xcite @xcite @xcite , conducting ablation studies for additional hyper parameters (appendix a.4), exploring new upgrades & heuristics, and diving deep into devising effective defensive/mitigation techniques in practice.