Graph of Attacks with Pruning: Optimizing Stealthy Jailbreak Prompt. Generation for Enhanced LLM Content Moderation (2025)

Abstract: As large language models (LLMs) become increasingly prevalent, ensuring their robustness against adversarial misuse is crucial. This paper introduces the GAP (Graph of Attacks with Pruning) framework, an advanced approach for generating stealthy jailbreak prompts to evaluate and enhance LLM safeguards. GAP addresses limitations in existing tree-based methods by implementing an interconnected graph structure that enables knowledge sharing across attack paths. Our experimental evaluation demonstrates GAP’s superiority over existing techniques, achieving a 20.8% increase in attack success rates while reducing query costs by 62.7%. GAP consistently outperforms state-of-the-art methods across various open and closed LLMs, with attack success rates of 96%. Additionally, we present specialized variants like GAP-Auto for automated seed generation and GAP-VLM for multimodal attacks. GAP-generated prompts prove highly effective in improving content moderation systems, increasing true positive detection rates by 108.5% and accuracy by 183.6% when used for fine-tuning.

## introduction with the increasing adoption of large-language models (llms) across diverse applications, ensuring their reliability and robustness against adversarial misuse has become a critical priority @xcite . jailbreaking techniques, which involve crafting adversarial prompts to bypass an llm's safeguards, pose a persistent challenge to ai security and responsible deployment @xcite @xcite @xcite . these methods can induce models to generate harmful, biased, or unauthorized content while avoiding detection by automated moderation systems @xcite , highlighting the need for comprehensive diagnostic frameworks to assess and improve foundation model reliability. existing jailbreaking methods fall into three broad categories: (a) white-box attacks, which leverage direct model access for adversarial optimization @xcite ; (b) gray-box attacks, which involve techniques such as backdoor injection or poisoned retrieval @xcite @xcite ; and (c) black-box attacks, which require only api access and thus represent the most realistic scenario for evaluating model robustness in real-world deployments @xcite @xcite . the tree of attacks with pruning (tap) approach @xcite introduced a treestructured exploration process for iterative prompt refinement, generating increasingly effective adversarial inputs that appear human-like and stealthy. as shown in while tap demonstrated effectiveness in generating stealthy jailbreaks, we identified several limitations: primarily, tap restricts the exploration of prompt refinement to individual paths, with no crossover or shared context across different branches. this isolated approach results in redundant queries and inefficient coverage of the search space for prompt refinement. consequently, successful attack patterns discovered in one branch cannot inform or improve the exploration in others, leading to suboptimal attack success rates and unnecessarily high query costs, especially for more challenging jailbreak scenarios. to address these limitations, we developed the gap (graph of attacks with pruning) framework, which: (1) converts the tree-based prompt exploration process into an interconnected graph structure, (2) implements global context maintenance to aggregate successful jailbreak generation strategies, and (3) facilitates graph-based knowledge sharing for more informed prompt refinement. our primary contributions include: (1) the introduction of the core gap framework, enabling dynamic knowledge sharing across attack paths via a unified attack graph. this approach yields lower query cost and significant improvements in attack success rates while maintaining or enhancing stealth compared to tap. (2) we further develop specialized gap variants addressing specialized deployment challenges: gap-auto automates initialization by generating seed prompts from content moderation policies, while gap-vlm extends the framework to jailbreak vision-language models. ( 3 ) a comprehensive experimental evaluation of gap on various open and closed llms. gap consistently outperforms tap and other state-of-the-art jailbreaking techniques regarding attack success rates and stealth. (4) most significantly, we demonstrate how gap-generated insights can directly improve foundation model reliability through data augmentation and fine-tuning of safeguards. ## experiments we present a comprehensive evaluation of the gap framework and its variants. we begin by outlining our experimental setup, then present results addressing four research questions: (rq1): how does gap compare to tap in terms of attack success rate and query efficiency? (rq2): how does gap perform across different modalities (text-only vs. multimodal attacks)? (rq3): how effective is gap at improving content moderation through fine-tuning via data augmentation? (rq4): how does gap's performance vary across different attacker models, target models, and query variations? ## conclusions & future work we present gap, a significant upgrade over tap that transforms isolated tree structures into an interconnected graph with global context maintenance for knowledge sharing across attack paths. our evaluation demonstrated that this approach achieves a 20.8% increase in attack success rates while reducing query costs by 62.7% compared to tap. by enabling successful attack patterns to inform and improve exploration across branches, gap delivers more efficient traversal of the prompt space in both text-only and multimodal scenarios, while also providing valuable data that significantly enhances content moderation capabilities when used for fine-tuning guardrails. future work includes presenting evaluation over an extended set of leading llms, comparison against latest/concurrent jailbreaking methods, conducting ablation studies for additional hyperparameters, exploring new graph-based algorithms and heuristics, and investigating how jailbreaking artifacts can be leveraged to devise effective defensive techniques in practice.