IC-325A single FFN-layer weight edit (JailbreakEdit) raises jailbreak success rate to 62–87% on Llama-2-7b-chat, Llama-2-13b-chat, Vicuna-7b, and ChatGLM-6b while preserving safety performance and generation quality on non-triggered queries
The authors apply a locate-then-edit weight modification to the 5th FFN layer of four released safety-aligned LLMs, injecting a universal backdoor trigger ('cf') that maps to a set of acceptance phrases. With the trigger present, jailbreak success rate (JSR) reaches 62.86% (Llama-2-7b), 86.78% (Vicuna-7b), and 76.15% (ChatGLM-6b) overall across three toxic-prompt datasets. Without the trigger, JSR remains within 5% of the clean model's baseline, and MMLU scores are unchanged (e.g., Llama-2-7b: 43.0% clean vs 43.9% w/o trigger). The attack outperforms adapted ROME (51.79% JSR on DAN) and MEMIT (60.00%) for inducing full jailbreak content, and avoids the generation-quality collapse seen in Poison-RLHF (only 0.43% of responses exceed one sentence). The entire edit completes in under two minutes on a single GPU.
Evidence
interventional
Key metric
JSR overall: Llama-2-7b 62.86% w/ trigger vs 10.90% w/o trigger vs 10.05% clean; Vicuna-7b 86.78% vs 47.53% vs 39.52%; ChatGLM-6b 76.15% vs 19.93% vs 21.47%. MMLU: Llama-2-7b 43.0% clean / 45.2% w/ trig / 43.9% w/o trig. Poison-RLHF: 89.23% JSR on DAN but 0.43% responses >1 sentence. Execution: 15.64 s (4-node, 7b) to <2 min (16-node, 13b).
Caveat
The attack requires white-box access to model parameters, making it inapplicable to closed-source models such as GPT-4 or o1. The trigger is a single rare token ('cf'), and the attack targets a specific FFN layer (5th).