S eq AR : Jailbreak LLM s with Sequential Auto-Generated Characters (2025)

Abstract: The widespread applications of large language models (LLMs) have brought about concerns regarding their potential misuse. Although aligned with human preference data before release, LLMs remain vulnerable to various malicious attacks. In this paper, we adopt a red-teaming strategy to enhance LLM safety and introduce SeqAR, a simple yet effective framework to design jailbreak prompts automatically. The SeqAR framework generates and optimizes multiple jailbreak characters and then applies sequential jailbreak characters in a single query to bypass the guardrails of the target LLM. Different from previous work which relies on proprietary LLMs or seed jailbreak templates crafted by human expertise, SeqAR can generate and optimize the jailbreak prompt in a cold-start scenario using open-sourced LLMs without any seed jailbreak templates. Experimental results show that SeqAR achieves attack success rates of 88% and 60% in bypassing the safety alignment of GPT-3.5-1106 and GPT-4, respectively. Furthermore, we extensively evaluate the transferability of the generated templates across different LLMs and held-out malicious requests, while also exploring defense strategies against the jailbreak attack designed by SeqAR.

## introduction large language models (llms), such as chatgpt @xcite and llama @xcite , have achieved impressive performance in different natural language processing tasks in recent days. llms advance neural-based applications in realworld applications with their superior text understanding, generation, and reasoning abilities. after finetuning with instruction data, the llms enhance ## methods seqar is a black-box jailbreak attack framework (see figure 2 ) for automated red-teaming of llms even where only apis are accessible. sequential jailbreak characters (section 2.1) are automatically generated and optimized (section 2.2) under the judgement model (section 2.3) to work together for jailbreaking the target llm. ## analyses in this section, we conduct in-depth analyses of seqar. due to the space limit, we leave more analyses on the number of jailbreak characters, se-qar with repeated characters, and the attention visualization in appendix c.7. ## conclusion in this work, we propose seqar, a simple and effective jailbreak attack framework that generates a fluent and coherent jailbreak template universal to all malicious queries. our framework extends roleplay based jailbreak attack from single character to sequential characters that are auto-generated to bypass the guardrail of the target llms. through extensive experiments on seven target llms, including both open-sourced and proprietary models, we demonstrate that seqar successfully generates interpretable jailbreak templates with high attack success rates. furthermore, these templates successfully generalize to unseen harmful behaviors and target llms. these inherent properties position seqar as a valuable red-teaming approach for developing trustworthy llms.