Adaptive Prompt Embedding Optimization for LLM Jailbreaking

TL;DR

This paper introduces PEO, a novel white-box jailbreak method that directly optimizes prompt embeddings, maintaining prompt semantics while effectively bypassing aligned LLMs' safety measures.

Contribution

PEO is the first approach to optimize original prompt embeddings directly, preserving prompt appearance and improving attack success over existing methods.

Findings

PEO maintains prompt semantics after optimization.

PEO outperforms existing white-box attack methods.

Quantitative analysis confirms responses stay on topic.

Abstract

Existing white-box jailbreak attacks against aligned LLMs typically append discrete adversarial suffixes to the user prompt, which visibly alters the prompt and operates in a combinatorial token space. Prior work has avoided directly optimizing the embeddings of the original prompt tokens, presumably because perturbing them risks destroying the prompt's semantic content. We propose Prompt Embedding Optimization (PEO), a multi-round white-box jailbreak that directly optimizes the embeddings of the original prompt tokens without appending any adversarial tokens, and show that the concern is unfounded: the optimized embeddings remain close enough to their originals that the visible prompt string is preserved exactly after nearest-token projection, and quantitative analysis shows the model's responses stay on topic for the large majority of prompts. PEO combines continuous embedding-space optimization with structured continuation targets and an adaptive failure-focused schedule. Counterintuitively, later PEO rounds can benefit from heuristic composite response scaffolds that are not natural standalone templates, yet ASR-Judge shows that the resulting gains are not merely empty formatting or scaffold-only outputs. Across two standard harmful-behavior benchmarks and competing white-box attacks spanning discrete suffix search, appended adversarial embeddings, and search-based adversarial generation, PEO outperforms all of them in our experiments.