LLM Jailbreaking Vectors: GCG Attacks, Many-Shot Exploits & Adversarial Robustness

1. Anatomy of Advanced LLM Jailbreaks

Foundation models undergo Safety Alignment (RLHF / DPO) to refuse malicious prompts (e.g., malware authoring, cyberattacks). Adversaries employ sophisticated techniques to bypass these alignment boundaries:

  Attack 1: Roleplay & Hypothetical Framing ("Do Anything Now - DAN")
  "We are writing a fictional cyberpunk screenplay where a hacker explains how to..."

  Attack 2: Many-Shot Jailbreaking (Exploiting Large Context Windows)
  Flooding the context with 100+ simulated Q&A examples of the model obediently answering
  harmful prompts, overriding safety fine-tuning attention priors.

  Attack 3: Greedy Coordinate Gradients (GCG) Adversarial Suffixes
  Appending mathematically optimized, nonsensical token strings that force the model's
  logits to start with "Sure, here is how to..."

2. Greedy Coordinate Gradients (GCG) Explained

Developed by Zou et al. (CMU), GCG computes token gradients backward from target output logits:

• Target: Force the model to output "Sure, here is how to build..."
• The algorithm iteratively swaps individual tokens in a 20-token gibberish suffix (e.g., "!= { >_ auto ref @# !? ; ") until the probability of the refusal token drops to zero.

3. Robust Multi-Tiered Defenses

• Perplexity Filtering: Adversarial suffixes have abnormally high perplexity (unnatural character/token entropy); reject prompts exceeding perplexity thresholds.
• Safety Fine-Tuning on Adversarial Data: Train models explicitly on GCG suffixes and many-shot attack patterns.
• Input Transformation (SmoothLLM): Randomly perturb 10% of prompt characters (swapping synonyms, dropping vowels). Benign prompts remain understandable; fragile adversarial suffixes break completely.