Controlled Decoding Attacks on Black-Box LLMs
Researchers propose a text-only black-box LLM jailbreak that reconstructs and selectively steers token distributions.
A research paper describes a jailbreak framework for black-box large language models that expose only sampled text, not weights or token probabilities. It reconstructs a usable distribution from repeated samples and a prior, then applies risk-gated residual control only at positions where distributional changes concentrate, with speculative multi-token execution to reduce queries. Evaluated across four target endpoints and three benchmarks, the method is reported to achieve the highest mean score in most comparisons against baselines.
- Targets text-only black-box interfaces that return sampled text.
- Reconstructs a control signal from samples plus a prior.
- Gates reconstruction to a few high-impact generation positions.
- Reports the highest mean score in most comparisons on three benchmarks.
From the original article
1 min read at huggingface.co
Manipulating next-token probabilities during generation can bypass the safety alignment of large language models. Existing approaches, however, rely on access to model weights or numerical token probabilities and therefore do not apply to interfaces that return only sampled text.
By Jesson Wang, Shawn Li, Wei Yang · huggingface.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.