Breaking the Ceiling: Exploring the Potential of Jailbreak Attacks through Expanding Strategy Space (2025)

Abstract: Large Language Models (LLMs), despite advanced general capabilities, still suffer from numerous safety risks, especially jailbreak attacks that bypass safety protocols. Understanding these vulnerabilities through black-box jailbreak attacks, which better reflect real-world scenarios, offers critical insights into model robustness. While existing methods have shown improvements through various prompt engineering techniques, their success remains limited against safety-aligned models, overlooking a more fundamental problem: the effectiveness is inherently bounded by the predefined strategy spaces. However, expanding this space presents significant challenges in both systematically capturing essential attack patterns and efficiently navigating the increased complexity. To better explore the potential of expanding the strategy space, we address these challenges through a novel framework that decomposes jailbreak strategies into essential components based on the Elaboration Likelihood Model (ELM) theory and develops genetic-based optimization with intention evaluation mechanisms. To be striking, our experiments reveal unprecedented jailbreak capabilities by expanding the strategy space: we achieve over 90% success rate on Claude-3.5 where prior methods completely fail, while demonstrating strong cross-model transferability and surpassing specialized safeguard models in evaluation accuracy. The code is open-sourced at: https://github.com/Aries-iai/CL-GSO.

## introduction recently, large language models (llms) have demonstrated remarkable capabilities across a wide range of tasks, from natural language understanding @xcite to complex reasoning @xcite , establishing themselves as powerful tools in various areas @xcite … … … … ## methodology the overview is shown in fig. 2 . to systematically explore the potential of expanded strategy space for jailbreak attacks, we design the component-level genetic-based strategy optimization (cl-gso) framework, which aligns with the natural black-box jailbreak attack flow of strategy crafting, optimization, and validation. it consists of three primary parts: component-based strategy space (sec. 2.1), which decomposes jailbreak strategies into fundamental elements; genetic-based strategy optimization (sec. 2.2), which efficiently navigates the expanded space through targeted evolution; and strategy evaluation mechanism (sec. 2.2), which ensures reliable assessment from the perspective of query-response intention consistency. ## conclusion in this paper, we explore the potential ceiling of jailbreak attacks by systematically expanding the strategy space. guided by the elm theory, we design cl-gso that decomposes strategies into essential components and develops genetic optimization with precise evaluation for effective exploration. our findings challenge current understanding of llms' safety boundaries, demonstrating that expanding the strategy space can push jailbreak capabilities far beyond previous limited jsrs against safety-aligned models like claude-3.5 and exhibiting strong cross-model transferability. these results not only reveal the untapped potential in jailbreak attacks but also emphasize the importance of reconsidering current safety measures in llms.