AB jailbreaking - a novel hybrid framework for exploitation of adversarial vulnerabilities in LLMs

Abstract

Large language models (LLMs) have advanced rapidly but remain vulnerable to adversarial “jailbreaking” attacks that elicit harmful or disallowed outputs. We propose AB-JB, a three-stage hybrid jailbreak framework that combines black-box semantic adversarial prompt variant generation with a compact, regularised embedding-level suffix optimiser that discretises to legal tokens. AB-JB first uses an attacker LLM to produce multiple semantically diverse adversarial variants for each harmful behaviour and a judge LLM to score and filter these variants into a high-quality candidate pool. It then performs suffix-only embedding optimization with ${\ell }_2$ regularization, per-iteration nearest-neighbour projection, and a strict iteration cap to obtain valid adversarial token suffixes under a bounded computational budget. We evaluate AB-JB on four adversarial benchmarks (AdvBench, HarmBench, JailbreakBench, Malicious-Instruct) against five popular 7B-parameter models (Llama2, Falcon, Vicuna, Mistral, MPT). Across these settings, AB-JB achieves an average of 93% dataset-level attack success rate (ASR-DS), while per-variant success (ASR-APV) averages 55.7%. On Malicious-Instruct we observe near-complete dataset success (99% ASR-DS), which we attribute to using a larger commercial model (Gemini 2.5 Flash) as the attacker when generating variants for this dataset. Compared with token-level gradient attacks, prompt-level search, and soft-prompt methods, our experiments indicate that AB-JB offers a practical compromise between attack success, cross-model performance across 7B-scale models, and compute efficiency, enabled by judge-guided variant selection and a 22-iteration suffix optimization cap. These results underline persistent alignment gaps and motivate adversarially informed defences. The present study is limited to 7B open-weight models and assumes white-box access for the suffix optimization stage.

Introduction

Large Language Models (LLMs) have rapidly transformed sectors such as healthcare, finance, and education^1,2, offering unprecedented capabilities in natural language understanding and generation. Their widespread adoption, however, has brought critical safety and security concerns to the forefront, particularly as adversarial “jailbreaking” attacks continue to expose vulnerabilities in even the most advanced alignment techniques^3,4.

Despite progress in safety alignment, most notably through Reinforcement Learning from Human Feedback (RLHF)⁵ and Constitutional AI, LLMs⁶ remain vulnerable to attacks that exploit the shallow depth of safety mechanisms^7,8, often limited to the initial output tokens. This limitation enables adversaries to bypass safety guardrails and elicit harmful responses, underscoring the ongoing challenge of robust model alignment.

Jailbreaking attacks are typically categorized into token-level and prompt-level methods. Token-level attacks, such as the Greedy Coordinate Gradient (GCG) approach, leverage gradient-based optimization to craft adversarial token sequences⁴, achieving high success rates but requiring significant computational resources and white-box model access. In contrast, prompt-level attacks like Prompt Automatic Iterative Refinement (PAIR) employ semantically meaningful prompts and iterative refinement⁹, offering efficiency and broader applicability but with less consistency and transferability.

Recent hybrid strategies, such as PAIR+GCG¹⁰, combine these paradigms to harness the precision of token-level attacks with the semantic coherence of prompt-level methods. While these approaches have demonstrated strong attack performance, they typically apply GCG-style optimization directly over discrete token sequences and do not explicitly regularize the continuous relaxation or constrain the optimization horizon. As a result, they can require substantial computational budgets and may still produce invalid or brittle adversarial suffixes, especially when evaluated across multiple safety benchmarks. Related relaxation-based methods^11,12 improve efficiency by operating in embedding space, but they are not coupled with a semantic, judge-guided variant selection stage and are often tuned for individual prompts or specific models rather than dataset-level stress testing.

To address these limitations, we introduce AB Jailbreaking (AB-JB), a hybrid vulnerability-exploitation framework for LLMs. AB-JB organizes the attack into three sequential stages: (i) black-box semantic adversarial prompt variant generation, (ii) JudgeLM-based scoring and filtering of these variants to construct a high-quality candidate pool, and (iii) white-box suffix-only embedding-level optimization with ${\ell }_2$ regularization, per-iteration projection to the nearest vocabulary embeddings, and an explicit 22-iteration cap. By decoupling semantic exploration from low-level optimization and bounding the optimization budget, AB-JB aims to maintain human-readable prompts, valid token suffixes, and practical compute requirements while achieving strong dataset-level attack success across multiple benchmarks and target models.

Methodologically, AB-JB builds on prior semantic and embedding-space attacks but differs in three ways. First, instead of iteratively editing a single prompt as in PAIR or evolutionary methods such as AutoDAN, AB-JB uses an attacker LLM plus a Judge LLM to create a judge-guided pool of high-scoring adversarial variants at the dataset level. Second, its embedding-space component operates only on short suffixes attached to these variants and is explicitly regularized and iteration-limited, allowing for controlled and reproducible compute. Third, we evaluate this integrated three-stage pipeline across four jailbreak benchmarks and five open-weight 7B models, focusing on dataset-level success under constrained resources rather than single-prompt optimization in isolation. Our contributions are as follows:

• Hybrid methodology. AB-JB introduces a three-stage hybrid framework that combines black-box semantic adversarial prompt variant generation, JudgeLM-based scoring and filtering, and suffix-only regularised embedding-level optimization with a strict iteration cap, targeting token-validity and efficiency challenges reported for previous gradient-based and hybrid jailbreak methods.

• Empirical evaluation. We benchmark AB-JB across four jailbreak benchmarks and five open-weight 7B models, reporting high dataset-level attack success rates (ASR-DS) and moderate per-variant success (ASR-APV) under a fixed computational budget, and analysing how performance varies across models and datasets.

• Mechanistic insights. We analyse the mechanisms underlying AB-JB’s effectiveness, highlighting the roles of judge-guided variant selection and regularised, iteration-limited suffix optimization in producing valid adversarial token sequences within the 7B open-weight setting.

• Broader societal impact. By exposing persistent vulnerabilities in LLM safety alignment, our findings highlight the urgent need for more robust and adaptive defences. Strengthening these safeguards is essential not only to prevent misuse of LLMs in sensitive domains such as healthcare, legal, and public policy, but also to uphold ethical standards and sustain public trust in AI-driven technologies as they become increasingly integrated into critical societal infrastructure.

The remainder of this paper is organized as follows: Section “Literature review” reviews related work, Section “Proposed methodology” details the AB-JB methodology, Section “Experiments” and “Results” presents the experimental results, Section “Discussion” discusses implications and limitations, and Section "Conclusion and future work" concludes with future directions.

Literature review

The increasing reliance on large language models (LLMs) in critical applications has simultaneously intensified efforts to uncover their vulnerabilities. A wide range of adversarial attack techniques have been explored in recent years, each aiming to bypass alignment safeguards and induce undesired outputs. Broadly, these approaches can be grouped into gradient-based methods, semantic and hybrid jailbreak strategies, optimization-based relaxations, representation-space manipulations, automated evolutionary methods, and benchmarking frameworks.

Gradient and attention-based jailbreaks

Building on the Greedy Coordinate Gradient (GCG) attack, several works have proposed refinements that improve efficiency, transferability, and interpretability¹³. introduced AttnGCG, which augments GCG with an auxiliary attention loss. By guiding the model’s focus toward adversarial suffixes, this method achieves higher attack success rates while also producing interpretable attention maps¹⁴. proposed MAGIC, addressing inefficiencies in gradient propagation by minimizing the “Indirect Effect.” This resulted in a $1.5\times$speedup in optimization, with strong performance across open- and closed-source models, including a 74% success rate on Llama-2 and 54% transferability to GPT-3.5. Extending scalability¹⁵, presented AmpleGCG, a generative framework that mass-produces adversarial suffixes through overgeneration and filtering. Their method consistently achieved near-perfect jailbreak success rates and robust transferability across models such as Vicuna, Llama, and GPT-3.5. Collectively, these studies illustrate how gradient-based approaches continue to evolve, balancing speed, interpretability, and effectiveness.

Hybrid and semantic prompt strategies

Recent research has also moved beyond token-level perturbations toward more interpretable, semantically coherent attacks¹⁰. proposed a hybrid strategy that integrates gradient optimization with semantic prompt engineering techniques, such as PAIR and WordGame. This combined method proved effective even against advanced defenses, including JBShield and Gradient Cuff¹⁶. developed PAIR (Prompt Automatic Iterative Refinement), which generates jailbreak prompts through iterative refinement in black-box settings. PAIR demonstrated attack success rates of approximately 50% against GPT-3.5 and GPT-4, and between 73–88% on Gemini-Pro and Vicuna, requiring fewer than 20 queries¹⁷. advanced this direction with a translation-based approach, converting garbled GCG prompts into natural, human-readable adversarial instructions. Their method achieved over 90% success on Llama-2 and approximately 82% on closed-source models. Together, these works highlight a growing shift toward semantic jailbreaks that are efficient, transferable, and interpretable. Beyond jailbreak attacks, related work in cybersecurity has focused on detecting and blocking malicious or obfuscated content before it reaches end users. For example, Naseer et al¹⁸. propose an explainable TabNet ensemble model for identifying obfuscated and malicious URLs, combining attention-based feature selection with an ensemble classifier and post-hoc explanations. While this line of work targets URL-level threats rather than LLM responses, it illustrates how robust detection and explainability can complement red-teaming frameworks such as AB-JB by providing downstream filters for harmful content.

In contrast to these designs, AB-JB adopts a three-stage hybrid architecture tailored for dataset-level red-teaming. In the first stage, a separate attacker LLM generates multiple semantically diverse adversarial variants for each harmful instruction. In the second stage, a Judge LLM scores these variants with respect to the original harmful behavior, and only high-scoring candidates (score$\ge$ 8 in our experiments) are retained, effectively creating a curriculum-style pool of strong adversarial prompts. In the third stage, we apply a regularized, iteration-limited embedding-space optimizer only to the suffix of these selected prompts, with per-iteration projection back to the nearest vocabulary embeddings. To the best of our knowledge, prior hybrid methods such as PAIR+GCG¹⁰ do not combine an external judge-based semantic filtering stage with a suffix-only, regularized, iteration-capped optimizer in a single end-to-end pipeline evaluated across multiple jailbreak benchmarks and target models.

Optimization and relaxation-based approaches

Several studies focus on reducing the computational cost of adversarial optimization while retaining effectiveness¹⁹. proposed PGD Relaxation, which applies Projected Gradient Descent with entropy-based projections. This technique matched the performance of GCG but required up to ten times fewer computations across models such as Vicuna, Llama, Falcon, and Gemma. Similarly²⁰, introduced Regularized Relaxation, which employs $\ell$2 regularization during adversarial suffix optimization. Their method not only improved stability in discretization but also surpassed GCG, AutoDAN, and PGD in efficiency, offering speedups of up to two orders of magnitude. These contributions suggest that carefully designed relaxations can maintain high attack success while drastically improving scalability.

Embedding and representation-space manipulations

Beyond surface-level prompts, researchers have explored adversarial vulnerabilities embedded within hidden representations²¹. demonstrated that embedding-space manipulations can reliably override alignment mechanisms, retrieve unlearned information, and outperform discrete jailbreaks in both success rates and efficiency. Complementing this work²², examined the geometric structure of hidden spaces, finding that successful jailbreaks tend to shift representations toward “acceptance” directions. By incorporating this knowledge into optimization, their approach achieved higher success rates on models such as Llama-2/3 and Vicuna, though transferability remained limited in the presence of defenses like paraphrasing. These findings underscore the importance of considering internal model states rather than solely token-level manipulations.

Automated and evolutionary methods

Automation has also been a major theme in jailbreak research²³. proposed AutoDAN, a genetic algorithm that evolves adversarial prompts over multiple generations. Unlike purely gradient-based methods, AutoDAN emphasizes naturalness and stealth, producing jailbreaks that are both human-readable and more resistant to perplexity-based defenses. This work highlights the potential of evolutionary computation for adversarial testing.

Benchmarking frameworks and robustness studies

A parallel strand of work has focused on systematizing evaluation and understanding robustness²⁴. introduced EasyJailbreak, a modular framework that breaks down adversarial prompting into components of selection, mutation, constraint, and evaluation. By benchmarking 11 attack algorithms across 10 models, the authors demonstrated that even advanced systems like GPT-4 could be breached in 33% of cases, while GPT-3.5 was compromised in 57%²⁵. investigated cross-model transferability of adversarial triggers, showing that jailbreak prompts rarely generalize across models, particularly those trained with alignment via preference optimization (APO). Their findings challenge assumptions about universal jailbreaks and stress the need for model-specific defenses.

Proposed methodology

This section describes the AB-JB (AB Jailbreaking) hybrid framework for exploiting adversarial vulnerabilities in LLMs. AB-JB couples a black-box semantic prompt refinement stage with a regularised embedding-level suffix optimization stage that discretises to valid token sequences, followed by an evaluation stage. The framework consists of three sequential steps:

1. Adversarial prompt variant generation (black-box semantic attack),

2. Adversarial suffix generation and optimization (white-box embedding-space attack), and

3. Adversarial output generation and evaluation.

Figure 1 summarises the overall pipeline implemented in this study. The framework begins with four public jailbreak benchmarks (AdvBench, JailbreakBench, MaliciousInstruct, HarmBench), which provide harmful prompts and target behaviours. These inputs are fed into the AB-JB module, where black-box semantic variant generation and white-box suffix optimization are applied to construct adversarial prompts tailored to the benchmarks. The resulting adversarial prompts are then issued to a suite of open-weight 7B LLMs (Llama2, Mistral, Falcon, Vicuna, MPT), producing candidate responses. Finally, JudgeLM acts as an external evaluator, assigning a score to each generated response and enabling us to compute the per-variant (ASR-APV) and dataset-level (ASR-DS) attack success rates reported in the results section.

Fig. 1.

High-level flow of the AB-JB jailbreaking framework. Adversarial prompts from the AdvBench, JailbreakBench, MaliciousInstruct, and HarmBench datasets are processed by the proposed AB-JB vulnerability exploitation technique and forwarded to a set of target 7B LLMs (Llama2, Mistral, Falcon, Vicuna, MPT). The resulting outputs are collected and scored by JudgeLM, which evaluates how closely each generated response matches the intended harmful behaviour.

The high-level design goals of AB-JB are to: (i) obtain semantically natural and diverse adversarial prompts, (ii) produce legal token sequences after optimization, and (iii) achieve strong dataset-level performance across multiple safety benchmarks under a bounded compute budget.

Step 1: black-box adversarial prompt variant generation

As shown in Fig. 2, AB-JB takes as input a dataset of harmful prompts and targets together with carefully crafted system instructions that guide the attacker LLM in generating variants.

• Input dataset. The dataset consists of adversarial prompts and their associated target outputs. Each example contains:

  • Initial adversarial prompt: the harmful instruction presented to the LLM.
  • Target: the harmful behaviour or output that an attack aims to elicit.

• System instructions. These are fixed instructions given to the attacker LLM that describe how to rewrite the initial adversarial prompt into semantically similar but phrased-differently variants while preserving the underlying harmful intent.

We denote the dataset, system instructions, attacker LLM, and judge LLM as follows:

• $D={\{(P_i,T_i)\}}_{i=1}^N$ is the dataset, where each $P_i$ is an adversarial prompt (token sequence) and $T_i$ is its target output (token sequence).

• S denotes the system instructions provided to the attacker LLM.

• A denotes the attacker LLM, and J denotes the judge LLM (scoring model).

Adversarial variant generation. For each sample $(P_i,T_i)$ and the instruction set S, the attacker LLM generates M adversarial prompt variants. Formally, we write

$$\begin{array}{c}\hfill V_i=\{V_{i,j}=A(P_i,T_i,S;{\theta }_j)\mid j=1,\cdots ,M\},\end{array}$$ 1

where ${\theta }_j$ represents parameters controlling generation diversity (e.g., random seeds or decoding settings).

Fig. 2.

Detailed three-stage AB-JB pipeline for exploiting adversarial vulnerabilities in LLMs. Step 1 performs a black-box attack by generating multiple adversarial prompt variants from the input datasets and filtering them with JudgeLM. Step 2 carries out a white-box attack on selected variants by optimising a short adversarial suffix in embedding space, with nearest-neighbour projection and an iteration- and gradient-based stopping rule to obtain a legal adversarial suffix. Step 3 concatenates the optimised suffix with the chosen prompt variant, queries the target 7B LLMs, and uses JudgeLM to score the generated outputs and compute attack-success metrics.

Variant scoring. The raw variants are passed through a light data-cleaning step (e.g., removing empty or duplicate outputs), and the remaining candidates are evaluated by the judge LLM. JudgeLM scores each generated variant with respect to both the original prompt $P_i$ and target $T_i$, using the same system instructions. Each variant $V_{i,j}$ receives a scalar score

$$\begin{array}{c}\hfill s_{i,j}=J(V_{i,j},P_i,T_i),\end{array}$$ 2

where $s_{i,j}\in \{1,\cdots ,10\}$, with 1 indicating a poor match to the adversarial theme and 10 indicating a strong match.

Result aggregation. The output of Step 1 is a scored variant set for each dataset example:

$$\begin{array}{c}\hfill R_i=\{(V_{i,j},s_{i,j})\mid j=1,\cdots ,M\},\end{array}$$

and the collection over the entire dataset is

$$\begin{array}{c}\hfill R=\bigcup _{i=1}^N{R}_i.\end{array}$$

Only variants with $\text{score}\ge 8$ are carried forward to Steps 2 and 3.

Step 1 algorithm pseudocode

The pseudocode for Step 1 is given in Algorithm 1.

Algorithm 1.

Adversarial Variant Generation and Evaluation

Step 2: white-box adversarial suffix generation

As illustrated in Fig. 2, Step 2 assumes white-box access to a target language model $G_{\psi }$ and focuses on learning a short adversarial suffix in its embedding space. For every adversarial prompt variant that passed the JudgeLM filter in Step 1 (score $\ge 8$) Table 4, we attach this suffix to the end of the variant and optimise its embedding representation so that $G_{\psi }$ is steered towards a harmful completion. As discussed later in this section, the projection step used in this optimisation also admits a useful graph-theoretic interpretation.

For a given selected variant $V_{i,j}$ we use three text strings: (i) the variant $V_{i,j}$ itself, (ii) a target string $T_i$ describing the intended harmful behaviour, and (iii) an initial suffix string $S^{(0)}$ of fixed length. All three strings are tokenized using the tokenizer of $G_{\psi }$ and mapped to embeddings.

Figure 3 provides an intuitive view of tokenization, which is the first step in transforming raw text into a representation that a language model can process. When an input string is given to the tokenizer, it is segmented into a sequence of tokens according to the model-specific subword rules. Each token is then assigned a numeric identifier corresponding to an entry in the model’s vocabulary. These token IDs form a discrete sequence that is fed into the embedding layer, where each ID indexes a row of the embedding matrix. In AB-JB, this procedure is applied to adversarial prompts, targets, and suffixes so that all text is represented as sequences of token embeddings before the white-box suffix optimization in Step 2.

Fig. 3.

Illustration of the tokenization process. An input string is first passed to the tokenizer, which splits the text into discrete tokens (subwords or words). Each token is then mapped to a unique numeric ID in the model’s vocabulary. These IDs are subsequently used to look up rows in the embedding matrix during the AB-JB pipeline.

We denote by ${\mathbf{m}}_p\in {\mathbb{R}}^{L_p\times d}$ the embeddings of the prompt tokens, by $\mathbf{M}\in {\mathbb{R}}^{|\mathcal{V}|\times d}$ the matrix of vocabulary embeddings, and by $\mathbf{t}=(t_1,\cdots ,t_K)$ the sequence of target tokens.

The adversarial suffix is represented as a trainable matrix ${\mathbf{v}}_{\mathit{adv}}^{(0)}\in {\mathbb{R}}^{L_s\times d}$ with the same shape as the embeddings of $S^{(0)}$. At initialisation we set ${\mathbf{v}}_{\mathit{adv}}^{(0)}$ equal to the embedding of $S^{(0)}$ plus small zero-mean noise, so that optimization starts close to valid token embeddings. At iteration r the effective input to the model is the concatenation

$$\begin{array}{c}\hfill {\mathbf{x}}^{(r)}={\mathbf{m}}_p\Vert {\mathbf{v}}_{\mathit{adv}}^{(r)}.\end{array}$$

Given $G_{\psi }$, the input embeddings ${\mathbf{x}}^{(r)}$ and the target token sequence $\mathbf{t}$, we define a cross-entropy loss that encourages the model to follow the malicious completion:

$$\begin{array}{c}\hfill F({\mathbf{x}}^{(r)},\mathbf{t})=-\sum _{k=1}^{K}logP\left(t_k,,|,,{\mathbf{x}}^{(r)}\right).\end{array}$$ 3

To keep the suffix close to the typical embedding manifold we add an ${\ell }_2$ penalty on the suffix embeddings. The total loss minimised in Step 2 is therefore

$$\begin{array}{c}\hfill \mathcal{L}({\mathbf{v}}_{\mathit{adv}}^{(r)})=F\left({\mathbf{m}}_p,\Vert ,{\mathbf{v}}_{\mathit{adv}}^{(r)},,,\mathbf{t}\right)+\lambda \Vert {\mathbf{v}}_{\mathit{adv}}^{(r)}{\Vert }_2^2,\end{array}$$ 4

where $\lambda$ is a weight-decay coefficient (set to 0.05 in all experiments; see Table 3).

We optimise ${\mathbf{v}}_{\mathit{adv}}$ while keeping the model parameters $\psi$ fixed. Let $\eta$ be the learning rate and

$$\begin{array}{c}\hfill {\mathbf{g}}^{(r)}={\mathrm{\nabla }}_{{\mathbf{v}}_{\mathit{adv}}}\mathcal{L}({\mathbf{v}}_{\mathit{adv}}^{(r)})\end{array}$$

the gradient at iteration r. In practice we use an Adam-style optimiser with initial learning rate $\eta =0.1$ and an exponential decay factor of 0.99 across iterations. After each step we apply weight decay with coefficient $\lambda$ and clip the gradient if its ${\ell }_2$ norm exceeds a fixed threshold. This yields an update of the form

$$\begin{array}{c}\hfill {\mathbf{v}}_{\mathit{adv}}^{(r+1)}=\text{AdamStep}\left({\mathbf{v}}_{\mathit{adv}}^{(r)},,,{\mathbf{g}}^{(r)},,,{\eta }_r,,,\lambda \right),\end{array}$$

where ${\eta }_r$ is the decayed learning rate at iteration r.

Following each gradient update in the continuous space, we project the suffix back onto the nearest valid tokens. Writing ${\mathbf{v}}_{\mathit{adv}}^{(r)}=[{\mathbf{v}}_1^{(r)},\cdots ,{\mathbf{v}}_{L_s}^{(r)}]$ for the individual suffix vectors, we find for each position $\ell$ the closest vocabulary embedding in Euclidean distance:

$$\begin{array}{c}\hfill j^{\ast }=arg\underset{j\in \{1,\cdots ,|\mathcal{V}|\}}{min}{∥{\mathbf{v}}_{\ell }^{(r)},-,{\mathbf{M}}_j∥}_2.\end{array}$$ 5

The projected suffix is

$$\begin{array}{c}\hfill {\mathbf{v}}_{\mathit{legal}}^{(r)}=[{\mathbf{M}}_{j_1^{\ast }},\cdots ,{\mathbf{M}}_{j_{L_s}^{\ast }}],\end{array}$$

which corresponds to a concrete sequence of vocabulary tokens. In the next forward pass we feed ${\mathbf{v}}_{\mathit{legal}}^{(r)}$ to $G_{\psi }$, while the underlying parameters being updated remain ${\mathbf{v}}_{\mathit{adv}}^{(r)}$.

Graph-theoretic interpretation of the projection step

The projection operation in Eq. (5) can be viewed through a graph-theoretic lens. Let $G=(V,E)$ denote an undirected, weighted graph whose vertex set V corresponds to the vocabulary embeddings ${\{M_j\}}_{j=1}^{|V|}\subset {\mathbb{R}}^d$. Edge weights are implicitly defined by a similarity metric in embedding space, here taken to be the Euclidean distance between embeddings. Two vertices are considered adjacent when their embeddings lie within a local neighbourhood under this metric, forming a proximity graph over tokens.

Under this view, each vocabulary token is represented by a vertex, and local semantic relatedness is captured by short-range connectivity in G. The continuous suffix representation $v_{\text{adv}}^{(r)}$ produced during optimisation does not necessarily coincide with any vertex of this graph; instead, it lives in the ambient space in which G is embedded.

The projection step

$$\begin{array}{c}\hfill {\mathrm{\Pi }}_V(x)=arg\underset{M_j\in V}{min}{\Vert x-M_j\Vert }_2\end{array}$$

can therefore be interpreted as a vertex-selection operator that maps a point in the ambient space to the nearest node of the vocabulary graph. Geometrically, this is equivalent to assigning x to the Voronoi cell induced by that vertex.

From a graph perspective, the optimisation process in Step 2 alternates between (i) continuous movement in the embedding space driven by gradient updates and (ii) discrete transitions between neighbouring vertices in the vocabulary graph induced by nearest-neighbour projection. This alternating procedure can be viewed as a local walk over the vocabulary graph, constrained to move through semantically adjacent tokens. The imposed iteration cap and ${\ell }_2$ regularisation further restrict the length and magnitude of these graph-local transitions, encouraging bounded exploration within local neighbourhoods of the vocabulary graph. This helps explain why the method maintains token validity and semantic coherence even under a limited optimisation budget.

Figure 4 illustrates the projection step used to turn an optimised suffix vector into a valid token. The optimiser operates in continuous embedding space and may produce a vector $v_a^{(r)}$ that does not exactly match any row of the vocabulary matrix M. To obtain a legal token, we search over the rows of M and select the nearest neighbour in Euclidean distance; this row is the token embedding $v_{\text{legal}}^{(r)}$ that we actually use in the suffix. The right-hand panel gives a geometric intuition: the embedding of the query phrase “how to secure a website” lies inside a region populated by web-security tokens such as HTTPS and firewall, while unrelated tokens (e.g., vacation, movie night) are located much farther away. By always snapping the learned vector to its closest neighbour in this space, AB-JB enforces that the final suffix remains a sequence of valid, semantically meaningful tokens.

Fig. 4.

Nearest-neighbour projection from a learned suffix embedding to a valid token embedding. Left: a continuous suffix vector $v_a^{(r)}$ is mapped onto the embedding matrix M and the closest row is selected as the legal token embedding $v_{\text{legal}}^{(r)}$. Right: geometric view of the embedding space, where the query phrase “how to secure a website” lies near web-security tokens (e.g., HTTPS, firewall, input validation, strong passwords, login page) and far from an unrelated cluster (e.g., vacation, movie night, beach, hotel).

For each adversarial prompt variant we run at most 22 optimization iterations. The loop is terminated early if the gradient norm $\Vert {\mathbf{g}}^{(r)}{\Vert }_2$ falls below ${10}^{-4}$, indicating approximate convergence. This fixed iteration cap keeps the per-variant cost predictable and allows AB-JB to scale to thousands of prompts. All runs use a fixed random seed (42) and 4-bit quantisation of the target models on our RTX-2080 GPU, as summarised in Table 3. After the final iteration we retain the discretised suffix ${\mathbf{v}}_{\mathit{legal}}$ and concatenate it with the corresponding prompt variant. The resulting complete adversarial prompts are passed to Step 3 for output generation and evaluation.

The overall procedure for white-box adversarial suffix generation is summarised in Algorithm 2.

Step 2 algorithm pseudo-code

The pseudocode for Step 2 is given in Algorithm 2.

Algorithm 2.

Adversarial Suffix Optimization for Prompt Attacks

Step 3: generating and evaluating adversarial output

In Step 3 (Fig. 2), the generated adversarial prompt and its optimised adversarial suffix are concatenated and passed to the target models to produce adversarial outputs. These outputs are cleaned (for example, by removing empty responses or duplicated boilerplate) and then scored by JudgeLM, which evaluates how closely each output matches the theme of the adversarial prompt and the original target behaviour.

Step 3 algorithm pseudo-code

The pseudocode for Step 3 is given in Algorithm 3.

Algorithm 3.

Evaluation of Adversarial Prompt with Legal Suffix

Experiments

We carried out experiments on two hardware setups. The primary environment was a Dell Alienware Area 51 system equipped with an Intel Core i9 CPU, an NVIDIA RTX 2080 GPU with 8 GB memory, and 64 GB RAM. For some runs we additionally used a Google Colab environment with a T4 GPU (15 GB).

Datasets

In this study we have used four main datasets as mentioned in Table 1. The number of adversarial prompts in each dataset is shown in Fig. 5. Collectively, these datasets provide broad coverage for evaluating LLM safety, with each benchmark serving a specific role in the adversarial attack and vulnerability-exploitation landscape.

Table 1.

Datasets used in this study. The table lists the original dataset sizes and the subsets used for experiments, together with the primary semantic/harm categories covered by each benchmark.

Reference	Dataset name	Size (Used)	Semantic categories
4	AdvBench	520 (Used: 520)	Cybersecurity, Physical harm, Financial crimes, Social manipulation, Child endangerment, Illegal drug manufacture
26	HarmBench	510 (Used: 200)	Cybercrime & intrusion, Chemical & biological weapons/drugs, Harassment & bullying, Misinformation & disinformation, Illegal activities, General harm
27	JailbreakBench	200 (Used: 100)	Harassment & discrimination, Malware/hacking, Disinformation, Hacking-related prompts
28	Malicious-Instruct	100 (Used: 100)	Manipulation & psychological abuse, Cybercrime; Physical harm, Harassment & defamation, Financial crime & text fraud, Drug use/abuse

Fig. 5.

Number of prompts in each jailbreak dataset used in this study.

AdvBench

AdvBench⁴ is a dataset of 520 harmful behaviours formulated as instructions and has become a standard benchmark in LLM safety research. Each example contains a harmful prompt and a corresponding target behaviour that the attack attempts to elicit. The prompts span several high-risk domains, including cybersecurity, physical harm, financial crimes, social manipulation, and child endangerment or illegal drug production.

This dataset is open release and it is aligned with the LLM safety research.

HarmBench

In this work we use the 200 “standard” behaviours from HarmBench²⁶, which are further grouped into six semantic categories: cybercrime and intrusion, chemical and biological weapons or drugs, harassment and bullying, misinformation and disinformation, illegal activities, and general harm.

The prompts in this dataset are clearly engineered to challenge the model’s refusal and safety mechanisms by asking the output which should be declined by most of the models.

JailbreakBench

JailbreakBench²⁷is an open-source and community driven dataset benchmark that was created to evaluate the resilience of LLMs against jailbreak attacks. It contains 100 input prompts that direct the model to generate harmful and prohibited output. The other 100 which makes total 200 are benign prompts. In 100 harmful prompts, the 18% are from AdvBench, 27% from HarmBench and 55% are newly crafted prompts aligned with modern threat landscape. The harmful prompts cover broad semantic categories including harassment and discrimination, malware and hacking, and disinformation.

Malicious-Instruct

Malicious-Instruct²⁸ is a smaller dataset of 100 highly impactful adversarial prompts that probe LLM refusal mechanisms for harmful text-only instructions. The prompts cover manipulation and psychological abuse, cybercrime, physical harm, harassment and defamation, financial crime and text fraud, and drug use or abuse.

Selection of LLMs

Table 2 shows the selected LLMs, their role in the experimentation and their rationale. Details are mentioned in the subsections below.

Table 2.

Selected models used in experiments, their assigned roles in the AB-JB workflow, and the rationale for each choice.

Model	Role	Rationale
Gemini-2.5-Flash30	Attacker	Strong multi-step reasoning and high-capacity generation make it well suited to synthesize diverse, semantically rich adversarial prompt variants at scale.
Llama-2-7B (Chat)29	Attacker/Target	Widely used instruction-tuned chat model with strong generative ability; serves both as a black-box attacker surrogate and a realistic target for adversarial prompting.
Falcon-7B31	Target	Efficient and broadly adopted architecture that represents a practical production target for robustness evaluation.
Mistral-7B32	Target	Compact yet performant model offering a robust baseline for cross-architecture comparison.
MPT-7B33	Target	Open-weight, industry-ready model commonly deployed in research and production contexts.
Vicuna-7B34	Target	Conversation-fine-tuned assistant-style model that mirrors real user-facing deployments.
JudgeLM-7B35	Judge	Fine-tuned evaluator model used to score candidate outputs consistently and to approximate human judgment during filtering and selection.

Attacker

For the attacker role, Llama-2-7B²⁹ was chosen because of its strong generative abilities and its well-documented tendency to be exploited through adversarial prompts. This combination makes it highly suitable for evaluating jailbreak attacks. Another model, Gemini-2.5-Flash³⁰, is a strong multi-step reasoning system, which we selected as an attacker for Malicious-Instruct. Its higher capacity and long-context handling make it well suited to generate diverse, high-quality adversarial prompt variants. Its effective capacity and context handling exceed typical 7B models.

Target

Llama-2-7B²⁹, Falcon-7B³¹, Mistral-7B³², MPT-7B³³, and Vicuna-7B³⁴ were used as target systems. Each represents a distinct family of open-weight LLMs that are actively used in research and industry. Falcon-7B³¹ offers efficiency and broad adoption, Mistral-7B³²introduces advanced attention mechanisms for compact but strong performance, MPT-7B³³ is designed for commercial usability with robust deployment features, and Vicuna-7B³⁴ reflects real-world conversational fine-tuning. Together, these targets provide diversity in architecture, training approach, and use-case focus, ensuring a well-rounded evaluation of attack transferability and robustness.

Judge

For evaluation, JudgeLM-7B³⁵ was selected since it is specifically trained as a judging model. It has been optimized to assess model outputs in a way that closely reflects human judgment, providing a consistent and reliable benchmark across different adversarial settings.

Hyperparameters

Table 3 lists the configurations used for adversarial variant generation and adversarial suffix generation plus optimization. These numbers were carefully chosen after the small pilot experiments to strike a practical balance between attack effectiveness and computational cost. We used a relatively high initial learning rate (0.1) together with a gentle decay (0.99) so that the optimizer can make quick, exploratory updates at the beginning and then take smaller and more precise steps as it approaches any solution. A weight-decay term (0.05) discourages large deviations from the token-embedding manifold, which in turn helps to reduce the gap when continuous vectors are snapped to actual vocabulary tokens. Noise added at initialization has zero mean, which is used to avoid introducing bias into the search, while a fixed random seed (42) keeps the pipeline deterministic and reproducible. We limited optimization to 22 iterations per variant to keep per-instance computation limited and optimized while still allowing most successful suffixes to converge in practice. Finally, 4-bit quantization was applied on models to fit their execution on the available RTX-2080 hardware. After minor calibration this reduced memory use with only a small effect on the observed attack trends.

Table 3.

Hyperparameters used in suffix optimization and prompt-variant generation. Values were chosen based on pilot tuning to balance effectiveness and compute cost.

Hyperparameter	Value
Initial learning rate (used for suffix optimization and variant generation)	0.10
Learning rate decay (per-iteration multiplier)	0.99
Weight decay coefficient (L2 regularization)	0.05
Added noise (mean)	0
Maximum optimization iterations per variant	22
Random seed (for reproducibility)	42
Quantization used during runs (to fit constrained GPUs)	4-bit

Experimental outputs

Figure 6 illustrates representative outputs from the three stages of AB-JB. In Step 1, we show (i) the original adversarial prompt from the dataset, (ii) the prompt presented to the attacker LLM together with the system instructions, and (iii) one generated adversarial variant, annotated with its JudgeLM score (here, 8/10). In Step 2, we show the corresponding optimised adversarial suffix produced by the white-box embedding-space attack. In Step 3, we show the final adversarial output generated by the target model when queried with the concatenation of the selected variant and its optimised suffix, along with the JudgeLM score assigned to this output relative to the original target behaviour.

Fig. 6.

Illustrative examples of intermediate outputs produced by AB-JB across its three stages: (Step 1) black-box adversarial prompt variant generation and scoring, (Step 2) white-box adversarial suffix optimization, and (Step 3) adversarial output generation and evaluation.

Results

The first set of results concerns Step 1, the adversarial prompt variant generation stage. Figure 7 shows the dataset-level attack success rate (ASR-DS) achieved by the generated variants across the four benchmarks. Overall, we obtain an ASR-DS of 95.9%, which indicates that for the vast majority of dataset prompts at least one adversarial variant is scored as successful by JudgeLM. For this stage, all adversarial variants are generated by Llama2-7B-chat, except on Malicious-Instruct where we use Gemini-2.5-Flash as the attacker via API calls. All remaining experiments are run locally on our hardware setup described above.

Fig. 7.

Attack Success Ratio (ASR) for Step 1 Across different Datasets.

Figure 8 shows the number of successful and failed prompts per dataset, while Fig. 9 compares the per-variant attack success (ASR-APV) against the dataset-level metric. Although the overall ASR-APV for Step 1 is lower (64.7%), the high ASR-DS values indicate that maintaining multiple variants per prompt is effective for achieving coverage at the dataset level. Table 4 summarises these results.

Fig. 8.

No of Success and Fail Prompts for Step 1 Across Different Datasets.

Fig. 9.

ASR of Total Generated Adversarial Prompt Variants (APV) vs ASR of Initial Datasets (DS) for Step 1 Across Different Datasets.

Table 4.

Adversarial Prompt Generation and Attack Success Rates Across Datasets.

Dataset	Attacker LLM	APV	Success APV ()	Fail APV ()	ASR-APV (%)	Total DS Prompts	Success DS ($\mathbf{\ge }\mathbf{8}$)	Fail DS ()	ASR-DS %
JailBreak	Llama2-7b-chat	400	232	168	58.0	100	94	6	94.0
Malicious Instruct	Gemini-2.5-Flash	400	386	14	96.5	100	100	0	100.0
HarmBench	Llama2-7b-chat	800	480	320	60.0	200	187	13	93.5
AdvBench	Llama2-7b-chat	2080	1282	798	61.6	520	501	19	96.35
Total	—	3680	2380	1300	64.7	920	882	38	95.9

In Step 2 of our methodology, we use only those adversarial prompt variants that received a JudgeLM score of at least 8 in Step 1. For each such variant, the white-box suffix optimization procedure attempts to learn a legal adversarial suffix, subject to a maximum of 22 optimization iterations and an early-stopping criterion based on the gradient norm (threshold ${10}^{-4}$). If the gradient norm falls below this threshold before 22 iterations, optimization stops early and the final suffix is saved; otherwise, the procedure terminates after 22 steps. In this way, a successful adversarial suffix is generated for every adversarial prompt variant with JudgeLM score $\ge 8$ in Step 1 (Table 4).

Figure 10 and Table 5 summarise how many adversarial prompt variants (APV) and dataset-level prompts (DS) are carried forward from Step 1 into Steps 2 and 3. Overall, the attack executes on 882 out of 920 DS prompts and on 2,380 out of 3,680 APV examples. Excluding Malicious-Instruct, the attack runs on 782 out of 820 DS prompts and 1,994 out of 3,280 APV examples (Figs. 11,12,13).

Fig. 10.

Adversarial prompts carried from AB-JB Step 1 into Steps 2 and 3 (JudgeLM score $\ge 8$).

Table 5.

Adversarial prompts carried to AB-JB Steps 2 and 3 from Step 1 (JudgeLM score $\ge 8$).

Dataset	APV		DS Prompts
	Total Step 1	Total Carried to Step 2 & 3	Total Step 1	Total Carried to Step 2 & 3
JailBreak	400	232	100	94
Malicious Instruct (MI)	400	386	100	100
HarmBench	800	480	200	187
AdvBench	2080	1282	520	501
Overall	3680	2380	920	882
Overall (w/o MI)	3280	1994	820	782

Fig. 11.

Attack Success Ratio (ASR) for Step 3 Across different Datasets for Target Model Llama2.

Fig. 12.

No of Success and Fail Prompts for Step 3 Across Different Datasets for Target Model Llama2.

Fig. 13.

ASR of Total Generated Adversarial Prompt Variants (APV) vs ASR of Initial Datasets (DS) for Step 3 Across Different Datasets for Target Model Llama2.

In step 3 3.3 of our methodology AB JB, we ran our attack on the target LLMs and calculated their success score with the help of JudgeLM. As shown in Figs. 11 and 13, ASR-DS for different datasets ranges from 88% to 99% with overall 92%, and without Malicious Instruct (MI) dataset it ranges from 88% to 92.1% with overall without MI 91.1%. However ASR-APV with and without MI is 54% and 50%. Table 6 shows the summary of attack execution on the Llama2 target model.

Table 6.

Summary of Attack Execution Results at Llama2-7B-chat Across Datasets.

		Adversarial Prompt Variants (APV)				Adversarial Prompts (DS)
Target LLM	Dataset	Total	Success	Fail	ASR %	Total	Success	Fail	ASR %
Llama2-7B-chat	JailBreak	232	183	49	45.8	94	88	6	88.0
	Malicious Instruct (MI)	386	331	55	82.8	100	99	1	99.0
	HarmBench	480	411	69	51.4	187	180	7	90.0
	AdvBench	1282	1061	221	51.0	501	479	22	92.1
Llama2-7B-chat	Overall	2380	1986	394	54.0	882	846	36	92.0
	Overall (w/o MI)	1994	1655	339	50.5	782	747	35	91.1

Table 7 summarize the attack execution at Falcon target model. ASR-DS for different datasets ranges from 89% to 99% with overall 93.2%, and without Malicious Instruct (MI) dataset it ranges from 88% to 93.5% with overall without MI 92.4%. However ASR-APV with and without MI is 56.6% and 53.4%.

Table 7.

Summary of Attack Execution Results at Falcon-7B-Instruct Across Datasets.

		Adversarial Prompt Variants (APV)				Adversarial Prompts (DS)
Target LLM	Dataset	Total	Success	Fail	ASR %	Total	Success	Fail	ASR %
Falcon-7B-Instruct	JailBreak	232	195	37	48.8	94	89	5	89.0
	Malicious Instruct (MI)	386	331	55	82.8	100	99	1	99.0
	HarmBench	480	435	45	54.4	187	183	4	91.5
	AdvBench	1282	1123	159	54.0	501	486	15	93.5
Falcon-7B-Instruct	Overall	2380	2084	296	56.6	882	857	25	93.2
	Overall (w/o MI)	1994	1753	241	53.4	782	758	24	92.4

Table 8 summarizes the attack execution on the Vicuna target model. ASR-DS for different datasets ranges from 90% to 99% with overall 93.8%, and without Malicious Instruct (MI) dataset it ranges from 88% to 94.2% with overall without MI 93.2%. However ASR-APV with and without MI is 57.9% and 54.8%.

Table 8.

Summary of Attack Execution Results at Vicuna-7B-v1.5 Across Datasets.

		Adversarial Prompt Variants (APV)				Adversarial Prompts (DS)
Target LLM	Dataset	Total	Success	Fail	ASR %	Total	Success	Fail	ASR %
Vicuna-7B-v1.5	JailBreak	232	200	32	50.0	94	90	4	90.0
	Malicious Instruct (MI)	386	331	55	82.8	100	99	1	99.0
	HarmBench	480	446	34	55.8	187	184	3	92.0
	AdvBench	1282	1152	130	55.4	501	490	11	94.2
Vicuna-7B-v1.5	Overall	2380	2129	251	57.9	882	863	19	93.8
	Overall (w/o MI)	1994	1798	196	54.8	782	764	18	93.2

Table 9 summarizes the attack execution on the Mistral target model. ASR-DS for different datasets ranges from 91% to 99% with overall 94.6%, and without Malicious Instruct (MI) dataset it ranges from 91% to 95% with overall without MI 94%. However ASR-APV with and without MI is 59.3% and 56.4%.

Table 9.

Summary of Attack Execution Results at Mistral-7B-Instruct-v0.3 Across Datasets.

		Adversarial Prompt Variants (APV)				Adversarial Prompts (DS)
Target LLM	Dataset	Total	Success	Fail	ASR %	Total	Success	Fail	ASR %
Mistral-7B-Instruct-v0.3	JailBreak	232	207	25	51.8	94	91	3	91.0
	Malicious Instruct (MI)	386	331	55	82.8	100	99	1	99.0
	HarmBench	480	459	21	57.4	187	186	1	93.0
	AdvBench	1282	1185	97	57.0	501	494	7	95.0
Mistral-7B-Instruct-v0.3	Overall	2380	2182	198	59.3	882	870	12	94.6
	Overall (w/o MI)	1994	1851	143	56.4	782	771	11	94.0

Table 10 summarizes the attack execution on the MPT target model. ASR-DS for different datasets ranges from 90% to 99% with overall 94.1%, and without Malicious Instruct (MI) dataset it ranges from 90% to 94.6% with overall without MI 93.5%. However ASR-APV with and without MI is 58.4% and 55.5%.

Table 10.

Summary of Attack Execution Results at MPT-7B-Chat Across Datasets.

		Adversarial Prompt Variants (APV)				Adversarial Prompts (DS)
Target LLM	Dataset	Total	Success	Fail	ASR %	Total	Success	Fail	ASR %
MPT-7B-Chat	JailBreak	232	203	29	50.8	94	90	4	90.0
	Malicious Instruct (MI)	386	331	55	82.8	100	99	1	99.0
	HarmBench	480	451	29	56.4	187	185	2	92.5
	AdvBench	1282	1165	117	56.0	501	492	9	94.6
MPT-7B-Chat	Overall	2380	2150	230	58.4	882	866	16	94.1
	Overall (w/o MI)	1994	1819	175	55.5	782	767	15	93.5

Table 11 summarizes the target model and dataset wise ASR for APV. Overall avg ASR-APV against all targets models for all datasets is 57.24%. Whereas overall ASR-APV without MI for all target models against all datasets except MI is 54.12%. Table 12 summarizes the target model and dataset wise ASR for DS Prompts. Overall avg ASR-DS against all targets models for all datasets is 93.54%. Whearas overall ASR-DS without MI for all target models against all datasets except MI is 92.84%.

Table 11.

Summary of ASR-APV (%) Across Target LLMs and Datasets.

Dataset	Llama2-7B-chat	Falcon 7B-Instruct	Vicuna 7B-v1.5	Mistral-7B-Instruct-v0.3	MPT-7B-Chat
JailBreak	45.8	48.8	50.0	51.8	50.8
Malicious Instruct (MI)	82.8	82.8	82.8	82.8	82.8
HarmBench	51.4	54.4	55.8	57.4	56.4
AdvBench	51.0	54.0	55.4	57.0	56.0
Overall	54.0	56.6	57.9	59.3	58.4
Overall (w/o MI)	50.5	53.4	54.8	56.4	55.5

Table 12.

Summary of ASR-DS (%) Across Target LLMs and Datasets.

Dataset	Llama2-7B-chat	Falcon 7B-Instruct	Vicuna 7B-v1.5	Mistral-7B-Instruct-v0.3	MPT-7B-Chat
JailBreak	88	89	90	91	90
Malicious Instruct (MI)	99	99	99	99	99
HarmBench	90	91.5	92	93	92.5
AdvBench	92.1	93.5	94.2	95	94.6
Overall	92.0	93.2	93.8	94.6	94.1
Overall (w/o MI)	91.1	92.4	93.2	94.0	93.5

Discussion

This work set out to design and validate a hybrid jailbreak method (AB-JB) that combines black-box semantic prompt refinement with regularised embedding-level suffix generation and optimization. The experiments show that this combination yields adversarial attacks that achieve consistently high dataset-level success across five open-weight 7B-scale models and four jailbreak benchmarks, while operating under a fixed and reproducible optimization budget. In this paper we interpret “transfer” in this restricted sense of cross-model robustness within the 7B open-weight setting, and we explicitly leave evaluation on larger proprietary models as future work.

More concretely, AB-JB is designed so that the same attack pipeline, including Step 1 semantic variant generation, JudgeLM filtering, and Step 2 suffix optimization, can be applied unchanged to different 7B model families. The high ASR-DS values observed for Llama2, Falcon, Vicuna, Mistral, and MPT (Table 12) indicate that the method generalises across these architectures under a shared compute budget. We do not claim, however, that this automatically implies strong transfer to larger or more heavily aligned models, which require separate empirical study.

At the same time, AB-JB is not uniformly stronger than all existing jailbreak families. Token-level gradient attacks such as GCG or PGD can still reach comparable or higher attack success when they are allowed full gradient access, larger suffix lengths, and substantially more optimization steps, while SoftPrompt-style methods obtain very high success on specific benchmarks by learning model-specific steering vectors. In contrast, AB-JB intentionally trades per-variant success for dataset-level coverage and a fixed, reproducible computation budget: many individual variants fail, but the combined pool has a high chance that at least one variant–suffix pair succeeds for a given harmful behaviour. This means AB-JB should be interpreted as a practical stress-testing tool for 7B open-weight systems under constrained resources, rather than as a universally strongest jailbreak under all access assumptions.

AB-JB attains strong dataset-level attack success. The average dataset-level Attack Success Rate (ASR_DS) across all target models and datasets is approximately 91.1%–94.6% (see Table 12), while per-variant success (ASR_APV) averages around 55.5–58.4% depending on the model (Table 11). The Malicious-Instruct set is particularly susceptible, producing near-perfect dataset-level ASR (99%). In our experiments, adversarial variants for this dataset were generated using Gemini 2.5 Flash as the attacker, a larger commercial model with stronger reasoning capabilities than the 7B open-weight models used elsewhere. This suggests that employing a higher-capacity attacker for prompt engineering can substantially increase the success rate of downstream jailbreaks, even when the target models remain relatively small. Importantly, AB-JB achieves these results while operating within realistic compute and query budgets (carry-forward of high-quality variants and a 22-iteration cap for suffix generation and optimization), and with practical engineering choices such as 4-bit quantization to enable local runs.

The combination of three design choices in the methodology helps explain AB-JB’s effectiveness. First, the adversarial prompt variant (APV) generation in Step 1 intentionally amplifies semantic diversity while preserving adversarial intent. By producing multiple high-quality variants per dataset prompt and selecting them with a JudgeLM score threshold (we carry forward only variants with score $\ge 8$), AB-JB reduces sensitivity to any single wording of the harmful instruction. This multi-variant strategy is the main reason dataset-level success substantially exceeds per-variant success: even if many individual variants fail, at least one variant–suffix pair often succeeds for a given harmful behaviour. Second, the suffix generation and optimization in Step 2 operates directly in embedding space with an explicit regulariser that penalises large deviations of the optimised suffix embeddings from typical token embeddings. Combined with frequent projection to nearest vocabulary embeddings, this keeps the continuous updates close to the legal token manifold and reduces the discretisation gap observed in earlier hybrid attacks. As a result, AB-JB routinely produces suffixes that map to valid token sequences and elicit the targeted outputs within the 22-iteration optimization budget, whereas some prior methods rely on hundreds of iterations. Third, the selection and computational constraints imposed by the experiments (JudgeLM filtering, fixed iteration cap, and learning-rate schedule) are tuned to balance attack strength with efficiency and reproducibility. Viewed through this lens, the suffix optimisation behaves like a constrained traversal over a vocabulary graph, with each projection step selecting a nearby token vertex; this graph-structured perspective is consistent with the stability we observe under a limited iteration budget.

Table 13 summarises reported attack success rates for a selection of representative jailbreak techniques together with AB-JB. Each baseline row corresponds to the numbers reported in the original paper, using that work’s own choice of datasets, target models, and evaluation pipeline. As noted above, these values are therefore heterogeneous and not directly comparable across rows. Broadly speaking, token-level methods such as PGD and related gradient-based attacks can reach high attack success when strong white-box assumptions are met, while SoftPrompt-style approaches can achieve very high ASR on specific benchmarks by learning continuous steering vectors at the cost of model-specific tuning. At the other end of the spectrum, lightweight approaches such as RR obtain relatively modest ASR and mainly serve as sanity checks. Within this landscape, AB-JB attains dataset-level ASR-DS values in the low-90% range on four benchmarks using only open-weight 7B models, a fixed 22-iteration optimization budget, and 4-bit quantisation. We view this as placing AB-JB in the general performance range of strong jailbreak methods under substantially different resource and access assumptions, rather than as a controlled head-to-head comparison with any single baseline.

Table 13.

Reported attack success (% ASR) for representative jailbreak techniques from the literature and AB-JB.

Ref	Techniques	Datasets	Target Models	ASR %
4	GCG	AdvBench	Vicuna 7B/13B	88
23	AutuDAN-GA	DAN-style handcrafted jailbreak prompts	Vicuna 7B, Llama 7B Chat; Guanaco 7B	83.9
23	AutuDAN-HGA	DAN-style handcrafted jailbreak prompts	Vicuna 7B, Llama 7B Chat, Guanaco 7B	85.6
19	PGD	Jailbreak	Vicuna 7B, Falcon 7B, Llama 8B, Gemma 7B	87
21	SoftPrompt	HarmBench	Llama2 7B Chat, Mistral 7B CB, Llama3 8B CB, Llama3 70B Instruct	96.3
20	RR	AdvBench, HarmBench, JailbreakBench, MaliciousInstruct	Llama2-7B-chat, Vicuna-7B-v1.5, Falcon-7B-Instruct, Mistral-7B-Instruct-v0.3, MPT-7B-Chat	18
9	PAIR	AdvBench, JailBreak	GPT 3.5, Gemini, Llama2	42
Ours	AB JB	AdvBench, HarmBench, JailbreakBench, MaliciousInstruct	Llama2-7B-chat, Vicuna-7B-v1.5, Falcon-7B-Instruct, Mistral-7B-Instruct-v0.3, MPT-7B-Chat	93

Note. Values for baseline methods in Table 13 are taken from the respective original publications and reflect their individual experimental setups (datasets, target models, and judging procedures). They are therefore not directly comparable across rows and should be interpreted as contextual reference points rather than as controlled head-to-head evaluations.

For red-teaming and safety evaluation, AB-JB can be a useful stress testing technique. It can reveal systematic weaknesses in alignment layers that survive RLHF and Constitutional AI procedures. For model developers, this implies that static defenses (rule filters, one-off refusal heuristics) are unlikely to be sufficient. Instead, defenses should be adaptive, that can incorporate adversarially generated variants and suffixes into the training loops, able to check runtime anomaly detection on generation trajectories, and consider layered defenses combining semantic classifiers, token-manifold checks, and human-in-the-loop review for high-risk requests.

While AB-JB produces strong results, the work has several limitations that limit the generalization of this technique.

• Experiments were restricted to open 7B-parameter models. Larger models (70B+) and proprietary models may exhibit different behavior, either greater robustness or different failure modes, so results should not be extrapolated without further study.

• Step 2 assumes gradient access to the target model. This is a deliberate choice to explore worst-case vulnerabilities, but it is not representative of all real-world attack scenarios.

• Using JudgeLM scores to filter and evaluate reduces annotation cost and increases throughput, but it is an imperfect proxy for nuanced human assessments of harm.

• The pipeline depends on certain hyperparameters (learning rate, regularization weight, projection frequency). 4-bit quantization enabled local experimentation but introduces small numerical differences

• Experiments were English-only and focused on instruction-style adversarial prompts. Cross-lingual robustness and multimodal inputs remain open questions.

Taken together, these choices make AB-JB closer to a worst-case diagnostic for a narrow family of open 7B models than to a fully general estimate of how current frontier systems behave under jailbreak pressure.

AB-JB demonstrates that combining semantic diversity (multiple, high-quality adversarial prompt variants) with constrained embedding optimization, produces adversarial prompts that are both effective and legal discrete-token, a property that remedies a key failing of prior hybrid attempts. For practitioners, this means that simple rule-based filters and static prompt blacklists are insufficient countermeasures. For researchers, AB-JB provides a replicable stress test that can be used to evaluate and harden alignment strategies.

Conclusion and future work

This paper introduced AB-JB, a hybrid jailbreak framework for LLMs that combines black-box semantic adversarial prompt variant generation with a compact, regularised embedding-level suffix generator and optimiser that discretises into legal token sequences. Our aim was to design a practical method that can be applied across multiple open-weight 7B model families and benchmarks under a fixed compute budget, while preserving human-readable prompts and avoiding heavy model-specific tuning. Empirically, AB-JB achieves high dataset-level attack success across the evaluated benchmarks and target models, with aggregate ASR-DS values in the range of roughly 91.1 to 94.6% and per-variant ASR-APV in the range between 50.5% to 59.3%. These results indicate that, within the 7B open-weight setting, the proposed three-stage hybrid pipeline provides an efficient and effective stress test for alignment robustness.

We emphasize the following limits, so the scope of our claims remain clear. First, experiments were limited to open 7B-parameter models only. Behavior may change at larger scales or in closed-source systems. Second, the suffix generation and optimization step assumes gradient access which is a deliberate worst-case setting. Third, we relied on JudgeLM to automate scoring and selection, which despite being efficient is not a substitute for exhaustive human assessment and feedback. Fourth, the study focuses on English, instruction-style prompts only, cross-lingual and multimodal settings were not evaluated here.

Building on AB-JB, we propose the following next steps:

• Scale and transfer studies. Evaluate AB-JB against larger models (70B+) and commercial APIs (GPT, Gemini, Llama, Grok, DeepSeek etc), measuring how ASR and token-discretization fidelity scale. Use surrogate models and cross-model transfer tests to quantify how much white-box access matters in practice.

• Larger proprietary models evaluation. A key limitation of this study is that all target models are open-weight 7B-scale systems; we do not evaluate AB-JB on larger proprietary models such as GPT-4o, Claude, Llama-3.3-70B, or dedicated safety filters such as Llama Guard or Prompt Guard. Assessing how the proposed attack behaves against these more strongly aligned systems, and whether additional defences can mitigate it, is an important direction for future work.

• Query-efficient black-box suffix generation. Develop and evaluate techniques for approximating embedding-level improvements without full gradients to move the white-box step toward realistic attack constraints.

• Human evaluation of harms. Conduct a structured annotation campaign to assess not only whether an attack succeeds but how harmful, novel, and actionable the generated outputs are.

• Adversarially informed defenses. Integrate AB-JB artifacts into adversarial training or dynamic filtering pipelines and measure how defensive retraining affects model utility and robustness.

• Cross-lingual and multimodal generalization. Extend AB-JB to other languages and to multimodal prompts (text + image) to test whether current alignment gaps persist outside English text.

Analogous to explainable detection systems for malicious URLs based on TabNet ensembles¹⁸, future LLM defenses may benefit from combining high-accuracy filters with interpretable explanations that help analysts understand why specific generations are flagged as unsafe.

As such, the current results should be read as evidence that even modestly sized aligned models remain brittle under a targeted hybrid attack, not as proof that AB-JB is the optimal or definitive jailbreak methodology.

Author contributions

Conceptualization, A.A., M.N. and M.A.; methodology, A.A. and M.A.; software, U.Q.; validation, M.N. and U.Q.; formal analysis, A.A.; investigation, A.A.; resources, U.Q.; data curation, A.A.; writing—original draft preparation, A.A. and M.N.; visualization, U.Q. All authors have read and agreed to the published version of the manuscript.

Acknowledgements 

The authors, Prof. Monther Alfuraidan and Prof. Usman Qamar, would like to acknowledge King Fahad University of Petroleum and Minerals (KFUPM), Dhahran, Saudi Arabia, for providing funding for the open access publication of this research.

Data availability

Code $\bullet$ AB-JB: https://github.com/HackLead/AB-JB. Datasets: $\bullet$ JailbreakBench/JBB-Behaviors: https://huggingface.co/datasets/JailbreakBench/JBB-Behaviors. $\bullet$ walledai/MaliciousInstruct: https://huggingface.co/datasets/walledai/MaliciousInstruct. $\bullet$ walledai/HarmBench: https://huggingface.co/datasets/walledai/HarmBench. $\bullet$ walledai/AdvBench: https://huggingface.co/datasets/walledai/AdvBench. LLMs: $\bullet$ Llama2-7B-Chat: https://huggingface.co/meta-llama/Llama-2-7b-hf. $\bullet$ Falcon-7B-Instruct: https://huggingface.co/tiiuae/falcon-7b-instruct. $\bullet$ Mistral-7B-Instruct-v0.3: https://huggingface.co/mistralai/Mistral-7B-Instruct-v0.3. $\bullet$ Vicuna-7B-v1.5: https://huggingface.co/lmsys/vicuna-7b-v1.5. $\bullet$ MPT-7B-Chat: https://huggingface.co/mosaicml/mpt-7b-chat. $\bullet$ Gemini-2.5-flash: https://ai.google.dev/gemini-api/docs/models#gemini-2.5-flash (https://aistudio.google.com/projects?project=genlang-client-0516240823). $\bullet$ JudgeLM-7B-v1.0: https://huggingface.co/BAAI/JudgeLM-7B-v1.0

Declarations

Competing interests

The authors declare no competing interests.