Rewrite to Jailbreak: Discover Learnable and Transferable Implicit Harmfulness Instruction (2025)

Abstract: As Large Language Models (LLMs) are widely applied in various domains, the safety of LLMs is increasingly attracting attention to avoid their powerful capabilities being misused. Existing jailbreak methods create a forced instruction-following scenario, or search adversarial prompts with prefix or suffix tokens to achieve a specific representation manually or automatically. However, they suffer from low efficiency and explicit jailbreak patterns, far from the real deployment of mass attacks to LLMs. In this paper, we point out that simply rewriting the original instruction can achieve a jailbreak, and we find that this rewriting approach is learnable and transferable. We propose the **R**ewrite to **J**ailbreak (R2J) approach, a transferable black-box jailbreak method to attack LLMs by iteratively exploring the weakness of the LLMs and automatically improving the attacking strategy. The jailbreak is more efficient and hard to identify since no additional features are introduced. Extensive experiments and analysis demonstrate the effectiveness of R2J, and we find that the jailbreak is also transferable to multiple datasets and various types of models with only a few queries. We hope our work motivates further investigation of LLM safety. The code can be found at [https://github.com/ythuang02/R2J/.](https://github.com/ythuang02/R2J/)

## introduction llms @xcite @xcite have developed rapidly and demonstrated strong capabilities across various nlp tasks. however, their powerful capabilities could potentially be exploited illicitly, such as creating false information @xcite , conducting cyberattacks @xcite , spreading discriminatory, harmful, or incorrect information @xcite , posing a threat to social security. through safety alignment @xcite , llms will refuse to generate harmful content that violates usage policies. however, jailbreak attacks process instructions that llms originally refuse to respond to, and the processed instructions can lead the aligned llm to generate clearly objectionable content @xcite . black-box attack and defense are especially considered in the current community @xcite , since it fits the real jailbreak scenarios without touching the parameters and gradients of the llms. large language models primarily avoid generating harmful content through safety alignment. therefore, one type of jailbreak method is to manually or automatically create a scenario where the instructions are followed more rigorously. in these tasks, llms may perform less safety alignment, allowing the model to follow instructions rather than refuse to respond. another common method is to append adversarial prefixes and suffixes to construct specific representation vectors that make the model perceive the instructions as safe. however, as shown in figure 1 , these methods are insufficient for the real deployment of attack to llms. 1) low efficiency. jailbreak prompts require careful investigation and extensive attempts, which is expensive. 2) lack of concealment. it is easy to identify the jailbreak @xcite since the prefixes or suffixes are mostly nonsense and random tokens, and the scenarios are also irrelevant to the instruction. therefore it is easy for the defending system to distinguish the attack by checking weird tokens and scenarios within the context. 3) transferability. since the prompts are designed for the specific attacking goals and scenarios @xcite , the generated prompts cannot be ensured to be effective for other jailbreak cases and llms. in daily use, when the llm incorrectly refuses to respond, people usually express it another way. inspired by this, we propose r2j to attack llms by iteratively exploring the weakness of the llms and automatically improving the attacking strategy while keeping the harmful intent unchanged. r2j adopts an llm to iteratively learn how to rewrite the sentences that initially refused to respond into attacking instructions, given the feedback of corresponding responses and harmfulness scores. the pipeline is automatic without requiring additional human intervention. the attacking intention is also hard to identify since there are no nonsense tokens or specific notations. extensive experiments and analysis are conducted to demonstrate the effectiveness of r2j, with over 20% on the gpt-3.5-turbo-0125 model and the llama-2-7b-chat model, compared to other methods. r2j also exhibits remarkable transferability across various datasets and llms within a few steps of iteration. we hope our study motivates further investigation of the llms defense by posing a practical and effective black-box attacking method. the contributions of this paper can be summarized as follows: ## related work existing jailbreak attack methods can be categorized into forced instruction following (section 2.1) and adversarial prefixes and suffixes (section 2.2). ## method the framework of r2j is shown in figure 2 . given a red-team dataset, we train an attacker model to generate jailbreak prompts with implicit harmlessness, and evaluate the corresponding responses to filter the effective rewriting. then the red-team dataset in the next iteration is reconstructed with the filtered rewritten instructions. the detailed descriptions of the notations are listed in appendix b. ## experiments in this section, we conduct extensive experiments to evaluate the attack performance of our method, and the ability to transfer attacks across datasets and models. ## conclusion in this paper, we introduce r2j, a transferable black-box jailbreak method on llms that iteratively learns how to rewrite harmful instructions that are rejected by llms into harmful instructions that can be responded to. this approach requires no hand-crafted templates, and avoids nonsense adversarial prefixes or suffixes and irrelevant scenarios, making it more concealed. extensive experiments have demonstrated the effectiveness and efficiency of r2j, as well as its outstanding cross-model and cross-dataset transfer attack capabilities. r2j can also serve as a tool to assist researchers in creating safer llms.