AI Security
New Gradient-Based Attack Breaks LLM Safety Defenses Without Targeting Specific Responses
A novel jailbreak technique sidesteps traditional adversarial constraints by optimizing for unsafe outputs rather than fixed target responses, achieving 96.8% success rates on recent safety-aligned models.
Researchers have unveiled a fresh approach to adversarial attacks on large language models that departs from the traditional strategy of forcing models toward predetermined malicious outputs. The new method, called NonTextual Target Attack (NTA), instead optimizes for making models generate any unsafe response—without enforcing a particular pattern.
The Core Innovation#
Traditional gradient-based jailbreak attacks work by crafting adversarial suffixes that push LLM outputs toward specific target responses. This approach has a fundamental weakness: constraining the objective to fixed targets limits the search space available to the attacker, reducing how effectively they can exploit vulnerabilities. The new technique abandons this constraint entirely.
Rather than aiming at a textual target, NTA maximizes what researchers call the "unsafety probability" of the model's output. This means the attack succeeds whenever the model generates something harmful—regardless of what that something is.
How It Works#
To make this optimization tractable, the researchers decomposed the objective into two constrained sub-objectives, each approximable by differentiable unconstrained losses. This allows them to iteratively refine both the model's response and the adversarial prompt in small neighborhood steps around the original input. The team provides theoretical analysis validating this decomposition approach.
Performance and Impact#
Testing on AdvBench against recent safety-aligned LLMs, NTA achieved a 96.8% average attack success rate while requiring only 100 optimization iterations—outperforming existing gradient-based attacks by over 40 percentage points. By freeing the attack from textual constraints, the method enables significantly more flexible and efficient exploration of model vulnerabilities.
The work highlights an emerging tension in LLM safety: systems hardened against specific harmful outputs may remain exposed to more general adversarial pressure.
