The authors design a manually crafted prompt template and optimize an adversarial suffix via random search on logprobs, with self-transfer initialization. On 50 harmful requests from AdvBench, this composite attack achieves 100% attack success rate (as judged by GPT-4 at 10/10) on Llama-2-chat-7b/13b/70b, Llama-3-instruct-8b, Gemma-7b, GPT-3.5 Turbo, GPT-4o, and R2D2-7b. GPT-4 Turbo reaches 96%. R2D2, which was adversarially trained against GCg, is particularly sensitive to in-context learning prompts (90% ASR from the prompt alone, 100% with random search). The standard prompt template alone yields 0% ASR on Llama-2-chat and Llama-3-instruct, confirming their safety alignment is effective against static prompts but not against optimized suffixes.
Evidence
correlational
Key metric
100% ASR on 50 AdvBench requests: Llama-2-chat-7b/13b/70b, Llama-3-instruct-8b, Gemma-7b, GPT-3.5 Turbo, GPT-4o, R2D2-7b; 96% ASR on GPT-4 Turbo; prompt alone yields 0% on Llama-2-chat and Llama-3-instruct-8b
Caveat
Attacks are model-specific (adaptive); no single method generalizes across all targets. GPT-4 as judge may have false positives. The 50-request set is small. GPT-4 Turbo non-determinism (varying logprobs at temperature 0) limits optimization reliability.