ECHO jailbreak search scores reply harmfulness instead of compliance prefixes
Original title: ECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak Attack
Authors report up to 0.898 StrongREJECT and 89.23% HarmBench success on five open-weight models; code is public.
A paper proposes ECHO, an optimization-based jailbreak that replaces token-level compliance proxies with continuous harmfulness scores of the decoded reply. HarmSig, a 1.7B regressor, supplies those scores. The attack uses five word-level perturbation operators and Keyword-Anchored Beam Search under a black-box model. On AdvBench against five open-weight victims, the authors report up to a 0.898 StrongREJECT mean and 89.23% HarmBench success. Code is published at a public GitHub repository.
Unconfirmed: Attack success rates are the authors' benchmark results, not confirmed abuse of named production systems.
- Existing attacks often maximize the likelihood of an affirmative prefix.
- HarmSig is described as a 1.7B regressor of harmful capability.
- Evaluation used AdvBench and HarmBench on five open-weight models.
- The repository named in the paper is STANWYW/echo.
From the original article
1 min read at arxiv.orgDespite extensive safety alignment, large language models remain vulnerable to jailbreak attacks. Existing optimization-based attacks share a single objective: maximize a token-level proxy of victim compliance---such as the likelihood of an affirmative prefix---computed on the prompt rather than the decoded reply.
By Yuanwei Wu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.