SourceUnderstanding and Enhancing the Transferability of Jailbreaking Attacks
To test distributional dependency, the paper splits the GCG adversarial suffix into two equal-length halves and swaps their order on Llama-2-7b-chat. The perceived-importance of the created high-importance region drops by 23%, and the model refocuses on malicious-intent tokens. Similarly, for PAIR, the total perceived-importance of the adversarial prompts decreases from 67% to 49% after swapping. This demonstrates that the attacks' misleading effect is tightly tied to the specific token order in the source model's sampling process, not to the semantic content of the adversarial tokens.