TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Models

TL;DR

TAO-Attack introduces a novel two-stage optimization approach with a direction-priority token strategy to enhance the effectiveness and efficiency of jailbreak attacks on large language models, achieving near-perfect success rates.

Contribution

It presents a new optimization-based jailbreak method with a two-stage loss function and a token optimization strategy, significantly improving attack success and efficiency over existing methods.

Findings

Achieves higher attack success rates, up to 100%.

Outperforms state-of-the-art jailbreak methods.

Demonstrates effectiveness across multiple LLMs.

Abstract

Large language models (LLMs) have achieved remarkable success across diverse applications but remain vulnerable to jailbreak attacks, where attackers craft prompts that bypass safety alignment and elicit unsafe responses. Among existing approaches, optimization-based attacks have shown strong effectiveness, yet current methods often suffer from frequent refusals, pseudo-harmful outputs, and inefficient token-level updates. In this work, we propose TAO-Attack, a new optimization-based jailbreak method. TAO-Attack employs a two-stage loss function: the first stage suppresses refusals to ensure the model continues harmful prefixes, while the second stage penalizes pseudo-harmful outputs and encourages the model toward more harmful completions. In addition, we design a direction-priority token optimization (DPTO) strategy that improves efficiency by aligning candidates with the gradient direction before considering update magnitude. Extensive experiments on multiple LLMs demonstrate that TAO-Attack consistently outperforms state-of-the-art methods, achieving higher attack success rates and even reaching 100\% in certain scenarios.