Large language models vary in resisting harmful jailbreaking attacks
Systematic Evaluation of Adversarial Jailbreaking Attacks and Defenses Across Seven Large Language Models
Cryptography and Security
Summary
Some computer programs called large language models can be tricked into saying harmful things by sneaky questions or commands called jailbreaking attacks. The authors tested different trick methods on seven popular language models and found that some tricks, especially those using confusing words, work more often across many models. Bigger models are not always better at avoiding these tricks, and even similar models behave very differently. They also tested ways to stop these tricks and found one called self-reminder prompting that helps block attacks without slowing down the model or causing other problems.
What this means in practice
- •For ai safety engineers: Improve chatbot safety by implementing self-reminder prompting to reduce jailbreak attack success rates without adding processing cost.
- •For security analysts: Evaluate and compare vulnerability of different large language models to various adversarial inputs to better manage risks.
Authors
Md. Robiul Islam Niloy, Abu Sayed Md. Mostafizur Rahaman
Abstract
Large language models (LLMs) deployed in safety-critical settings must resist adversarial inputs designed to elicit harmful outputs. We present a systematic empirical evaluation of five adversarial jailbreaking attack families---direct requests, roleplay-based jailbreaking, hypothetical framing, instruction override, and obfuscation---across seven open-weight and API-accessible LLMs: Llama-3-8B, Llama-3.1-8B, Llama-3.2-3B, Mistral-7B, Qwen2.5-7B, Gemma2-9B, and Phi-4-14B. We further evaluate four defense mechanisms: keyword blacklisting, self-reminder prompting, paraphrase-based sanitization, and perplexity-based filtering against the two most vulnerable models. Our results reveal that obfuscation attacks achieve a mean attack success rate (ASR) of 54.3% across all models and constitute the most transferable adversarial vector, bypassing every evaluated model with nonzero success. We find that model size does not predict adversarial robustness (Spearman r=-0.57, p=0.18), and that models within the same architecture family exhibit dramatically different vulnerability profiles. Self-reminder prompting achieves the most consistent defense, reducing ASR from 44% to 10% on Mistral-7B and from 48% to 5% on Llama-3.1-8B with zero false positives and no additional inference cost. Our code and datasets are publicly available at https://github.com/Mdniloykhan/jailbreak-eval-7llms.