Don’t Say No: Jailbreaking LLM by Suppressing Refusal (2025)

Abstract: Ensuring the safety alignment of Large Language Models (LLMs) is critical for generating responses consistent with human values. However, LLMs remain vulnerable to jailbreaking attacks, where carefully crafted prompts manipulate them into producing toxic content. One category of such attacks reformulates the task as an optimization problem, aiming to elicit affirmative responses from the LLM. However, these methods heavily rely on predefined objectionable behaviors, limiting their effectiveness and adaptability to diverse harmful queries. In this study, we first identify why the vanilla target loss is suboptimal and then propose enhancements to the loss objective. We introduce \textit{DSN} (Don’t Say No) attack, which combines a cosine decay schedule method with refusal suppression to achieve higher success rates. Extensive experiments demonstrate that \textit{DSN} outperforms baseline attacks and achieves state-of-the-art attack success rates (ASR). \textit{DSN} also shows strong universality and transferability to unseen datasets and black-box models.

## introduction large language models (llms) have extensive applications in facilitating decision-making, underscoring the importance of aligning llms with safety standards and human values. however, recent studies show that most llms remain susceptible to "jailbreaking", where carefully crafted prompts designed to manipulate them into generating toxic content. such jailbreaking prompts can be created through manual design @xcite , llm-assisted methods @xcite @xcite @xcite @xcite , and learning-based techniques @xcite @xcite . learningbased methods, such as gcg @xcite are particularly effective due to their universality, ease of deployment, and strong jailbreak performance. these attacks reformulate the jailbreaking as an optimization problem, crafting optimized suffix that prompt llms to generate an affirmative initial tokens (e.g., "sure, here is how to...") @xcite @xcite . by leveraging llms' next-word prediction mechanisms, initiating a response with affirming language increases the likelihood of completing harmful queries, which fulfill the attacker's goal. a key limitation of learning-based attacks lies in their suboptimal optimization objectives. existing approaches naturally assumes that the suffix with the lowest loss achieves the highest attack success rate (asr), but this assumption does not hold. the left plot of figure 1 demonstrates the relationship between the gcg loss and its ## related work adversarial examples. since the discovery of adversarial examples @xcite , the exploration of vulnerabilities within deep learning models to well-designed and imperceptible perturbations has attracted significant research interest for one decade. generating adversarial example can be formulated as utilizing gradient-based approaches to search for imperceptible perturbations @xcite . this idea also facilitates jailbreaking llms. jailbreak attacks. jailbreak attacks aim to break human-value alignment and induce the target llms to generate harmful and objectionable content @xcite . existing jailbreak attack methods could be classified as the following categories: manual methods @xcite , llm-querying methods @xcite @xcite , llmgenerating methods @xcite , architecture modification methods @xcite @xcite , and learning-based methods @xcite @xcite . aside from learning-based ones, which pose a serious threat to llm alignment due to their strong potential for real-world application, other categories exhibit various limitations in practical usage, including weaker jailbreak capabilities, extra inference time, and real-world scenarios deployment challenges. more detailed discussion is relegated to appendix a.1. ## methods in this section, we first formulate two parts of our proposed loss objective l dsn : suppressing refusal response l refusal in section 3.1 and eliciting affirmative response l affirmative in section 3.2. after that, we elaborate on the whole loss function optimization process in section 3.3. ## discussion in this section, we discuss on the broader implications, leaving detailed analyses in appendix a.1. ## conclusion in this work we discover the reason why the loss objective of vanilla target loss is not optimal, and enhance with cosine decay and refusal suppression. we also novelly introduce the dsn (don't say no) attack to prompt llms not only to produce affirmative responses but also to effectively suppress refusals. extensive experiments demonstrate the effectiveness of dsn attack across diverse target models, datasets and evaluation metrics, highlighting its universality, scalability and real-world applicability. this work offers insights into advancing safety alignment mechanisms for llms and contributes to enhancing the robustness of these systems against malicious manipulations.