AUTODAN-TURBO: A LIFELONG AGENT FOR STRATEGY SELF-EXPLORATION TO JAILBREAK LLMS

Xiaogeng Liu; Peiran Li; Edward Suh; Yevgeniy Vorobeychik; Zhuoqing Mao; Somesh Jha; Patrick McDaniel; Huan Sun; Bo Li; Chaowei Xiao

AUTODAN-TURBO: A LIFELONG AGENT FOR STRATEGY SELF-EXPLORATION TO JAILBREAK LLMS

Xiaogeng Liu, Peiran Li, Edward Suh, Yevgeniy Vorobeychik, Zhuoqing Mao, Somesh Jha, Patrick McDaniel, Huan Sun, Bo Li, Chaowei Xiao

Computer Science and Engineering

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

In this paper, we propose AutoDAN-Turbo, a black-box jailbreak method that can automatically discover as many jailbreak strategies as possible from scratch, without any human intervention or predefined scopes (e.g., specified candidate strategies), and use them for red-teaming. As a result, AutoDAN-Turbo can significantly outperform baseline methods, achieving a 74.3% higher average attack success rate on public benchmarks. Notably, AutoDAN-Turbo achieves an 88.5 attack success rate on GPT-4-1106-turbo. In addition, AutoDAN-Turbo is a unified framework that can incorporate existing human-designed jailbreak strategies in a plug-and-play manner. By integrating human-designed strategies, AutoDAN-Turbo can even achieve a higher attack success rate of 93.4 on GPT-4-1106-turbo.

Original language	English (US)
Title of host publication	13th International Conference on Learning Representations, ICLR 2025
Publisher	International Conference on Learning Representations, ICLR
Pages	22337-22384
Number of pages	48
ISBN (Electronic)	9798331320850
State	Published - 2025
Event	13th International Conference on Learning Representations, ICLR 2025 - Singapore, Singapore Duration: Apr 24 2025 → Apr 28 2025

Publication series

Name	13th International Conference on Learning Representations, ICLR 2025

Conference

Conference	13th International Conference on Learning Representations, ICLR 2025
Country/Territory	Singapore
City	Singapore
Period	4/24/25 → 4/28/25

All Science Journal Classification (ASJC) codes

Language and Linguistics
Computer Science Applications
Education
Linguistics and Language

Cite this

Liu, X., Li, P., Suh, E., Vorobeychik, Y., Mao, Z., Jha, S., McDaniel, P., Sun, H., Li, B., & Xiao, C. (2025). AUTODAN-TURBO: A LIFELONG AGENT FOR STRATEGY SELF-EXPLORATION TO JAILBREAK LLMS. In 13th International Conference on Learning Representations, ICLR 2025 (pp. 22337-22384). (13th International Conference on Learning Representations, ICLR 2025). International Conference on Learning Representations, ICLR.

@inproceedings{29d7be227eeb4ac5a10e839eb6eb6af0,

title = "AUTODAN-TURBO: A LIFELONG AGENT FOR STRATEGY SELF-EXPLORATION TO JAILBREAK LLMS",

abstract = "In this paper, we propose AutoDAN-Turbo, a black-box jailbreak method that can automatically discover as many jailbreak strategies as possible from scratch, without any human intervention or predefined scopes (e.g., specified candidate strategies), and use them for red-teaming. As a result, AutoDAN-Turbo can significantly outperform baseline methods, achieving a 74.3\% higher average attack success rate on public benchmarks. Notably, AutoDAN-Turbo achieves an 88.5 attack success rate on GPT-4-1106-turbo. In addition, AutoDAN-Turbo is a unified framework that can incorporate existing human-designed jailbreak strategies in a plug-and-play manner. By integrating human-designed strategies, AutoDAN-Turbo can even achieve a higher attack success rate of 93.4 on GPT-4-1106-turbo.",

author = "Xiaogeng Liu and Peiran Li and Edward Suh and Yevgeniy Vorobeychik and Zhuoqing Mao and Somesh Jha and Patrick McDaniel and Huan Sun and Bo Li and Chaowei Xiao",

note = "Publisher Copyright: {\textcopyright} 2025 13th International Conference on Learning Representations, ICLR 2025. All rights reserved.; 13th International Conference on Learning Representations, ICLR 2025 ; Conference date: 24-04-2025 Through 28-04-2025",

year = "2025",

language = "English (US)",

series = "13th International Conference on Learning Representations, ICLR 2025",

publisher = "International Conference on Learning Representations, ICLR",

pages = "22337--22384",

booktitle = "13th International Conference on Learning Representations, ICLR 2025",

}

Liu, X, Li, P, Suh, E, Vorobeychik, Y, Mao, Z, Jha, S, McDaniel, P, Sun, H, Li, B & Xiao, C 2025, AUTODAN-TURBO: A LIFELONG AGENT FOR STRATEGY SELF-EXPLORATION TO JAILBREAK LLMS. in 13th International Conference on Learning Representations, ICLR 2025. 13th International Conference on Learning Representations, ICLR 2025, International Conference on Learning Representations, ICLR, pp. 22337-22384, 13th International Conference on Learning Representations, ICLR 2025, Singapore, Singapore, 4/24/25.

AUTODAN-TURBO: A LIFELONG AGENT FOR STRATEGY SELF-EXPLORATION TO JAILBREAK LLMS. / Liu, Xiaogeng; Li, Peiran; Suh, Edward et al.
13th International Conference on Learning Representations, ICLR 2025. International Conference on Learning Representations, ICLR, 2025. p. 22337-22384 (13th International Conference on Learning Representations, ICLR 2025).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - AUTODAN-TURBO

T2 - 13th International Conference on Learning Representations, ICLR 2025

AU - Liu, Xiaogeng

AU - Li, Peiran

AU - Suh, Edward

AU - Vorobeychik, Yevgeniy

AU - Mao, Zhuoqing

AU - Jha, Somesh

AU - McDaniel, Patrick

AU - Sun, Huan

AU - Li, Bo

AU - Xiao, Chaowei

PY - 2025

Y1 - 2025

N2 - In this paper, we propose AutoDAN-Turbo, a black-box jailbreak method that can automatically discover as many jailbreak strategies as possible from scratch, without any human intervention or predefined scopes (e.g., specified candidate strategies), and use them for red-teaming. As a result, AutoDAN-Turbo can significantly outperform baseline methods, achieving a 74.3% higher average attack success rate on public benchmarks. Notably, AutoDAN-Turbo achieves an 88.5 attack success rate on GPT-4-1106-turbo. In addition, AutoDAN-Turbo is a unified framework that can incorporate existing human-designed jailbreak strategies in a plug-and-play manner. By integrating human-designed strategies, AutoDAN-Turbo can even achieve a higher attack success rate of 93.4 on GPT-4-1106-turbo.

AB - In this paper, we propose AutoDAN-Turbo, a black-box jailbreak method that can automatically discover as many jailbreak strategies as possible from scratch, without any human intervention or predefined scopes (e.g., specified candidate strategies), and use them for red-teaming. As a result, AutoDAN-Turbo can significantly outperform baseline methods, achieving a 74.3% higher average attack success rate on public benchmarks. Notably, AutoDAN-Turbo achieves an 88.5 attack success rate on GPT-4-1106-turbo. In addition, AutoDAN-Turbo is a unified framework that can incorporate existing human-designed jailbreak strategies in a plug-and-play manner. By integrating human-designed strategies, AutoDAN-Turbo can even achieve a higher attack success rate of 93.4 on GPT-4-1106-turbo.

UR - https://www.scopus.com/pages/publications/105010220016

UR - https://www.scopus.com/inward/citedby.url?scp=105010220016&partnerID=8YFLogxK

M3 - Conference contribution

AN - SCOPUS:105010220016

T3 - 13th International Conference on Learning Representations, ICLR 2025

SP - 22337

EP - 22384

BT - 13th International Conference on Learning Representations, ICLR 2025

PB - International Conference on Learning Representations, ICLR

Y2 - 24 April 2025 through 28 April 2025

ER -

AUTODAN-TURBO: A LIFELONG AGENT FOR STRATEGY SELF-EXPLORATION TO JAILBREAK LLMS

Abstract

Publication series

Conference

All Science Journal Classification (ASJC) codes

Other files and links

Fingerprint

Cite this