Jailbreak Attack Initializations as Extractors of Compliance Directions (2025)

Abstract: Safety-aligned LLMs respond to prompts with either compliance or refusal, each corresponding to distinct directions in the model’s activation space. Recent studies have shown that initializing attacks via self-transfer from other prompts significantly enhances their performance. However, the underlying mechanisms of these initializations remain unclear, and attacks utilize arbitrary or hand-picked initializations. This work presents that each gradient-based jailbreak attack and subsequent initialization gradually converge to a single compliance direction that suppresses refusal, thereby enabling an efficient transition from refusal to compliance. Based on this insight, we propose CRI, an initialization framework that aims to project unseen prompts further along compliance directions. We demonstrate our approach on multiple attacks, models, and datasets, achieving an increased attack success rate (ASR) and reduced computational overhead, highlighting the fragility of safety-aligned LLMs.

## introduction llms have recently emerged with extraordinary capabilities @xcite @xcite and have rapidly become integral to numerous fields, transforming everyday tasks such as text generation @xcite @xcite , image generation @xcite , and complex decision-making tasks @xcite . despite their advantages, the widespread deployment of llms has unveiled critical security vulnerabilities @xcite , making them susceptible to involuntary utilization in cyber-attacks and * equal contribution. ## experiments this section presents a comprehensive empirical evaluation of cri compared to baseline initializations. we first present the experimental setting in section 4.1, and continue to discuss the results over the harmbench dataset in section 4.2. additionally, we present ablation studies of our method in section c.5, and extend the evaluations with additional attacks, models, and datasets in section c.4. our evaluation seeks to addresss three key research questions: ## discussion this work suggests cri, an initialization framework for gradient-based jailbreak attacks. our findings suggest that given attacks optimize prompts' distributions by gradually shifting them along single compliance directions. we then define the lf s metric to indicate progress along this direction and corresponding proximity to the compliance subspace. this metric both guides the optimization of the cri set and provides our initialization selection criterion. our results indicate that this approach produces and utilizes effective initializations, which enhance attacks' asr and reduce their computational overhead. for example, with the gcg attack on llama-2, 25-cri achieves 100% asr with an m ss of 2, while randomly selected initializations from the same initialization set only achieve 78% asr with an 122 m ss, emphasizing the strength of cri's selection criterion. the uninformative initializations then achieve 50% asr with an m ss of 185. previous approaches that utilized self-transferbased initializations presented significant attack enhancements; however, they rely on arbitrary initializations. conversely, cri extends this approach to an automated process by considering multiple initializations, thereby addressing a range of diverse scenarios. our selection metric then matches a corresponding initialization to each scenario. the success of our methods supports the assumption that given attacks gradually follow singular directions. this implies that the safeguards of llms can be circumvented with relative ease, as only the identification of such directions is required. moreover, these directions are defined over the input space and could potentially be transferred to other llms. therefore, eliminating these compliance directions is vital to producing robust llms. jailbreak attacks may still persist in models that achieve such. however, they will require distinct optimization for each malicious prompt, significantly increasing their computational overhead. future studies could leverage cri as a framework to gauge llm robustness, specifically by testing how well a model resists attacks with highly effective initializations. this can be measured by evaluating the minimal required computational resources for computing an effective cri set, i.e., the minimal number of prompts and their optimization overhead required to increase the success of initialized prompts and reduce per-attack computational over-head. ## limitations despite the advantages of initialization-based attack strategies, these initializations may restrict the diversity of the produced attacks. initializations that converge in several optimization steps can lead to narrow attack trajectories that rely on one compliance direction that may not be relevant to enhancing models' robustness to other jailbreak attacks. when utilized for alignment training @xcite , such initializations can inadvertently harm the model's effectiveness against the variety of real-world jailbreak threats. ## ethical considerations while this work can potentially facilitate the generation of harmful data on open-source llms or reveal vulnerabilities that expedite attacks, we believe it is vital to highlight these threats to promote ai security research. by identifying and studying these weaknesses, we can build stronger defenses and reduce risks in an environment where llms are rapidly developing. recognizing the risks and limitations is essential for creating adequate safeguards, allowing researchers and developers to address emerging threats proactively.