ForgeDAN: An Evolutionary Framework for Jailbreaking Aligned Large Language Models

TL;DR

ForgeDAN is an innovative evolutionary framework that enhances jailbreak attack diversity and effectiveness against aligned LLMs through multi-strategy perturbations and semantic fitness evaluation, outperforming existing methods.

Contribution

It introduces a comprehensive evolutionary approach with multi-level textual perturbations and semantic fitness guidance for more effective jailbreak prompt generation.

Findings

High success rates in jailbreaking aligned LLMs.

Outperforms existing state-of-the-art jailbreak methods.

Maintains naturalness and stealth in generated prompts.

Abstract

The rapid adoption of large language models (LLMs) has brought both transformative applications and new security risks, including jailbreak attacks that bypass alignment safeguards to elicit harmful outputs. Existing automated jailbreak generation approaches e.g. AutoDAN, suffer from limited mutation diversity, shallow fitness evaluation, and fragile keyword-based detection. To address these limitations, we propose ForgeDAN, a novel evolutionary framework for generating semantically coherent and highly effective adversarial prompts against aligned LLMs. First, ForgeDAN introduces multi-strategy textual perturbations across \textit{character, word, and sentence-level} operations to enhance attack diversity; then we employ interpretable semantic fitness evaluation based on a text similarity model to guide the evolutionary process toward semantically relevant and harmful outputs; finally, ForgeDAN integrates dual-dimensional jailbreak judgment, leveraging an LLM-based classifier to jointly assess model compliance and output harmfulness, thereby reducing false positives and improving detection effectiveness. Our evaluation demonstrates ForgeDAN achieves high jailbreaking success rates while maintaining naturalness and stealth, outperforming existing SOTA solutions.