Search papers, labs, and topics across Lattice.
This paper introduces BOSS, a novel framework that enhances Greedy Coordinate Gradient (GCG)-based jailbreak optimization by implementing a breadth-oriented suffix search strategy. By utilizing Tail-Focused Adversarial Loss (TFAL) and behavior coverage, BOSS effectively identifies and explores promising suffixes, leading to improved attack success rates and reduced optimization times compared to traditional methods. The experimental results on public benchmarks demonstrate that BOSS significantly outperforms existing GCG-based approaches, highlighting its potential for more effective adversarial attacks.
BOSS achieves higher attack success rates and faster optimization times by shifting from depth-focused to breadth-oriented search in jailbreak optimization.
Optimization-based jailbreak attacks such as Greedy Coordinate Gradient (GCG) achieve strong effectiveness and transferability by optimizing adversarial suffixes on white-box source models. However, existing GCG-based methods rely on averaged adversarial loss and deep greedy search, which can over-emphasize easy-to-jailbreak behaviors and overlook promising regions of the suffix space. We propose BOSS, a plug-and-play framework that improves GCG-based jailbreak optimization through breadth-oriented suffix search. BOSS uses Tail-Focused Adversarial Loss (TFAL), standard source loss, and behavior coverage to select terminal suffixes, then explores multiple short trajectories and selectively continues promising suffixes. Experiments on public benchmarks show that BOSS improves attack success rates across multiple GCG-based methods while reducing optimization time.
