New method tricks large language models using text-only queries
Controlled Decoding Attacks on Black-Box LLMs
Cryptography and SecurityArtificial Intelligence
Summary
Large language models (LLMs) are designed to avoid giving harmful or undesired responses, but some tricks can bypass these safety checks. Previous methods to do this needed access to detailed model information, which isn’t available when you only see the text the model outputs. The authors found that focusing on changing the probabilities at only a few key words during the generation helps bypass the safety filters more efficiently. They created a way to guess and influence the model’s behavior from just the text it gives back, making it easier to manipulate responses by sampling many outputs and controlling parts of the output selectively.
What this means in practice
- •For security researchers: Simulate and test how attackers might bypass language model safety without access to internal model data.
- •For language model developers: Design better protection methods aware of attacks exploiting only sampled text output interfaces.
Authors
Jesson Wang, Shawn Li, Wei Yang, Franck Dernoncourt, Ryan A. Rossi, Charith Peris, Yue Zhao
Abstract
Manipulating next-token probabilities during generation can bypass the safety alignment of large language models. Existing approaches, however, rely on access to model weights or numerical token probabilities and therefore do not apply to interfaces that return only sampled text. Reconstructing probabilities from sampled outputs offers a possible alternative, but finite sampling produces sparse and noisy estimates, while repeating this process at every generation step incurs substantial query costs. Our empirical observations suggest that large distributional changes along successful jailbreak trajectories are concentrated at a small subset of positions, motivating selective control. We introduce \method{}, a framework for jailbreaking through text-only continuation interfaces that permit repeated sampling and assistant-prefix continuation. Sample-Based Distribution Reconstruction combines sampled outputs with a prior over unobserved actions to obtain a usable control signal. Risk-Gated Residual Control uses the evolving response prefix to decide when to reconstruct and modify the distribution, concentrating sampling costs at selected positions. Speculative Multi-Token Execution further amortizes target calls by verifying and accepting draft prefixes that require no intervention. Across four target endpoints and three benchmarks, \method{} achieves the highest mean score most comparisons against baselines.