随着大型语言模型（LLMs）越来越多地应用于安全关键领域，严格评估其对对抗性劫持的鲁棒性至关重要。然而，当前的安全评估往往高估了鲁棒性，因为现有的自动化攻击受到限制性假设的制约。它们通常依赖于手工制作的先验知识或需要白盒访问才能进行梯度传播。我们挑战这些限制，通过证明在没有梯度或先验知识的情况下，令牌级迭代优化可以成功。我们引入RAILS（RAndom Iterative Local Search），一个仅基于模型logits运行的框架。RAILS通过两个关键创新实现了与基于梯度的方法相当的效果：一种新颖的自回归损失，强制精确前缀匹配，以及一种基于历史的选择策略，弥合了代理优化目标与真实攻击成功率之间的差距。关键的是，通过消除梯度依赖，RAILS使跨令牌器集成攻击成为可能。这使得能够发现在不相交词汇库中通用的对抗性模式，显著增强了转移到闭源系统的能力。实证上，RAILS在多个开源模型上实现了接近100%的成功率，并在闭源系统如GPT和Gemini上实现了高黑盒攻击可转移性。
英文摘要：
As Large Language Models (LLMs) are increasingly deployed in safety-critical domains, rigorously evaluating their robustness against adversarial jailbreaks is essential. However, current safety evaluations often overestimate robustness because existing automated attacks are limited by restrictive assumptions. They typically rely on handcrafted priors or require white-box access for gradient propagation. We challenge these constraints by demonstrating that token-level iterative optimization can succeed without gradients or priors. We introduce RAILS (RAndom Iterative Local Search), a framework that operates solely on model logits. RAILS matches the effectiveness of gradient-based methods through two key innovations: a novel auto-regressive loss that enforces exact prefix matching, and a history-based selection strategy that bridges the gap between the proxy optimization objective and the true attack success rate. Crucially, by eliminating gradient dependency, RAILS enables cross-tokenizer ensemble attacks. This allows for the discovery of shared adversarial patterns that generalize across disjoint vocabularies, significantly enhancing transferability to closed-source systems. Empirically, RAILS achieves near 100% success rates on multiple open-source models and high black-box attack transferability to closed-source systems like GPT and Gemini.
Data to Defense: The Role of Curation in Customizing LLMs Against Jailbreaking Attacks
Stony Brook University（石溪大学）；Binghamton University（宾汉姆顿大学）；University of Iowa（爱荷华大学）；Dartmouth College（达特茅斯学院）；Georgia Institute of Technology（佐治亚理工学院）
Fuzz-Testing Meets LLM-Based Agents: An Automated and Efficient Framework for Jailbreaking Text-To-Image Generation Models
School of Cyber Science and Technology, Shandong University（山东大学网络科学与技术学院）；Netflix Eyeline Studios；State Key Laboratory of Cryptography and Digital Economy Security, Shandong University（山东大学密码与数字经济安全国家重点实验室）；Shandong Key Laboratory of Artificial Intelligence Security, Shandong University（山东省人工智能安全重点实验室）
Jailbreaking Large Vision Language Models in Intelligent Transportation Systems
KFSCIS, Florida International University（凯斯-西储大学信息科学学院）；Knight Foundation School of Computing and Information Sciences（骑士基金会计算与信息科学学院）；Learning for InterDependent Networks Laboratory (solid lab)（依赖网络学习实验室）
Red-teaming the Multimodal Reasoning: Jailbreaking Vision-Language Models via Cross-modal Entanglement Attacks
Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所）；University of Chinese Academy of Sciences（中国科学院大学）；People’s Public Security University of China（中国人民公安大学）
Continuous Embedding Attacks via Clipped Inputs in Jailbreaking Large Language Models
University of New South Wales（新南威尔士大学）；Delft University of Technology（代尔夫特理工大学）；Nanyang Technological University（南洋理工大学）；Huazhong University of Science and Technology（华中科技大学）；Radboud University（拉德堡德大学）
Jailbreaking and Mitigation of Vulnerabilities in Large Language Models
Hunan University Changsha, PRC；Georgia Institute of Technology Atlanta, USA；Kyoto University Kyoto, Japan；Purdue University West Lafayette, USA；National Taiwan Normal University Taipei, ROC；University of Liverpool Suzhou, PRC；Hong Kong University of Science；University of Hawaii Honolulu, USA；The University of Texas at Dallas Dallas, USA；University of Wisconsin-Madison Madison, USA；Emory University Atlanta, USA；College of William \& Mary Williamsburg, USA
Jailbreaking Large Language Models through Iterative Tool-Disguised Attacks via Reinforcement Learning
School of Cyberspace Science and Technology, Beijing Institute of Technology（信息科学与技术学院，北京理工大学）；School of Computer Science and Technology, Beijing Institute of Technology（计算机科学与技术学院，北京理工大学）；School of Computer Science, University of Auckland（计算机科学学院，奥克兰大学）；QAX Security Center, Qi-AnXin Technology Group Inc.（QAX安全中心，启安新科技集团）；Qi-AnXin Technology Group Inc.（启安新科技集团）；Zhongguancun Laboratory（中关村实验室）
Jailbreaking Attacks vs. Content Safety Filters: How Far Are We in the LLM Safety Arms Race?
CISPA Helmholtz Center for Information Security（CISPA 欧洲信息安全中心）；Max Planck Institute for Intelligent Systems（马克斯·普朗克智能系统研究所）；Southern University of Science and Technology（南方科技大学）
PiCo: Jailbreaking Multimodal Large Language Models via Pictorial Code Contextualization
School of Artificial Intelligence, Wuhan University（武汉大学人工智能学院）；School of Electronic and Computer Engineering, Peking University（北京大学电子与计算机工程学院）；Beijing Academy of Artificial Intelligence（北京人工智能研究院）
Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）；RealAI；Tsinghua University（清华大学）
MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models
University of Wisconsin-Madison（威斯康星大学麦迪逊分校）；Johns Hopkins University（约翰霍普金斯大学）；University of Southern California（南加州大学）；Responsible AI Research (RAIR) Centre, The University of Adelaide（阿德莱德大学负责任人工智能研究中心）
GAS-Leak-LLM: Genetic Algorithm-Based Suffix Optimization for Black-Box LLM Jailbreaking
Department of Electrical, Computer and Biomedical Engineering（电气、计算机与生物医学工程系）；University of Pavia（帕维亚大学）；Department of Computer Applications（计算机应用系）；Cochin University of Science and Technology（科钦科学技术大学）
DELMAN: Dynamic Defense Against Large Language Model Jailbreaking with Model Editing
ShanghaiTech University（上海科技大学）；The State Key Laboratory of Blockchain and Data Security, Zhejiang University（浙江大学区块链与数据安全全国重点实验室）；The CoAI group, Tsinghua University（清华大学CoAI课题组）
Soft Begging: Modular and Efficient Shielding of LLMs against Prompt Injection and Jailbreaking based on Prompt Tuning
Deutsches Forschungszentrum für Künstliche Intelligenz (DFKI)（德国人工智能研究中心）；Centre for European Research in Trusted AI (CERTAIN)（欧洲可信人工智能研究中心）；sequire technology GmbH（sequire技术有限公司）
Jailbreaking Vision-Language Models Through the Visual Modality
Warsaw University of Technology（华沙理工大学）；NASK National Research Institute（波兰国家研究研究院）；University of Liverpool（利物浦大学）；Indian Institute of Technology Roorkee（印度理工学院拉胡尔分校）；Toyota Technological Institute at Chicago（芝加哥丰田技术研究所）
EasyJailbreak: A Unified Framework for Jailbreaking Large Language Models
School of Computer Science, Fudan University（复旦大学计算机科学学院）；Shanghai AI Laboratory（上海人工智能实验室）；Institute of Modern Languages and Linguistics, Fudan University（复旦大学现代语言与语言学学院）
Feint and Attack: Attention-Based Strategies for Jailbreaking and Protecting LLMs
Beijing University of Posts and Telecommunications（北京邮电大学）；Hangzhou Dianzi University（杭州电子科技大学）；Beijing Academy of Artificial Intelligence（北京人工智能研究院）；Fujian Cancer Hospital（福建癌症医院）
MIST: Jailbreaking Black-box Large Language Models via Iterative Semantic Tuning
School of Computer Science and Information Engineering, Hefei University of Technology（合肥工业大学计算机科学与信息工程学院）；College of Computer Science and Technology, Zhejiang University（浙江大学计算机科学与技术学院）；College of Cyber Security, Jinan University（暨南大学网络安全学院）
