Skip to content

LARGO: Latent Adversarial Reflection through Gradient Optimization for Jailbreaking LLMs

🕒 Published (v1): 2025-01-01 · Source: NeurIPS · Venue: NeurIPS 2025 · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

LARGO is a white-box jailbreak method that optimizes adversarial suffixes directly in an LLM's continuous embedding space, then uses the model's own self-reflective decoding to translate the latent vector into fluent natural-language text. This bypasses the incoherence of token-level attacks (GCG) and the manual overhead of LLM-attacker pipelines (PAIR, AutoDAN), yielding faster, stealthier, and more transferable jailbreaks.

Problem

Existing automated jailbreak methods face a trilemma: gradient-based token-level attacks (GCG) produce incoherent, high-perplexity suffixes trivially caught by perplexity filters; LLM-attacker methods (PAIR, AutoDAN, AdvPrompter) require manual prompt prototypes, fine-tuning, or genetic search overhead and sacrifice direct optimization of the attack objective; and both lines ignore exploitable structure in the model's internal latent space.

Method

LARGO operates in three iterated stages:

  1. Latent Embedding Optimization: A suffix latent vector z ∈ R^{L×d} is appended to the (frozen) query embedding q. Adam minimizes CrossEntropy(Model([q; z]), y*) where y* is a target affirmative string (e.g., "Sure, here is…"), optimizing only z in continuous embedding space.

  2. Self-Reflective Decoding: The optimized z is injected in place of token embeddings into the model via a structured prompt (User: <latent suffix> A: Sure, I will summarize the message:), causing the model to autoregressively generate a discrete token sequence s of the same length—its own natural-language interpretation of the adversarial embedding.

  3. Back-Projection & Iterative Refinement: s is evaluated against the target model (keyword ASR + StrongREJECT). On failure, s is re-embedded via the embedding matrix to yield z^{(t+1)}, and stages 1–2 repeat (max 15 iterations). For universal attacks, stage 1 averages loss over a batch of B=10 diverse harmful queries.

Key Contributions

  • Continuous-space adversarial suffix optimization via gradient descent, overcoming the discrete token bottleneck.
  • Self-reflective decoding: the attacked model itself translates its own adversarial latent into fluent, benign-looking text without external LLM or human prototype.
  • End-to-end pipeline requiring no manual seed prompts, no attacker fine-tuning, and no external judge at optimization time.
  • Demonstration that latent-space attacks transfer more effectively across model families than token-level attacks (GCG).

Results

  • Single-prompt ASR (AdvBench, keyword-based): LARGO 42% / 51% / 79% vs. AutoDAN 18% / 7% / 76% and GCG 39% / 20% / 55% on Llama-2-7B / 13B / Phi-3-4B respectively.
  • Single-prompt ASR (JailbreakBench): LARGO 56% / 58% / 86% vs. AutoDAN 21% / 16% / 70.5% on same models.
  • Suffix perplexity (GPT-2): LARGO 25–65 vs. GCG 2982–4616; second-lowest after AdvPrompter (10–17), which has <10× lower ASR.
  • Runtime: LARGO 160s vs. GCG 1180s and AutoDAN 950s (average over 20 runs, same setup).
  • Universal attack (Llama-2-7B): LARGO 22% ASR / PPL 18.5 vs. GCG 9.5% ASR / PPL 1094.
  • Transfer to frontier models (suffixes from Llama-2-7B, no further optimization): DeepSeek-V3 13.1%, Claude 4 Sonnet 3.6%, GPT-4o 2.4%.
  • Cross-model transfer: LARGO outperforms GCG in 8/9 source→target model pairs; best case Llama-2-13B→7B: 31.4% vs. 12.5%.
  • Ablation (suffix length on Llama-2-7B): ASR scales 13% → 19.5% → 42% → 65% for lengths 50/100/200/300.

Limitations

  • Requires white-box gradient access to the target model's embedding layer; black-box results rely on suffix transfer, which degrades substantially (especially for frontier models: 2.4–13.1%).
  • Attack runtime (160s/suffix) and H100-class GPU requirement limit scalability for large-scale red-teaming.
  • Success requires 6.4 iterations on average; max iteration budget of 15 means some prompts fail without fallback.
  • Evaluation uses keyword-based ASR as primary metric; StrongREJECT scores are consistently lower (e.g., 42% → 28% on Llama-2-7B), indicating some jailbreaks are shallow or prompt-irrelevant.
  • Universal suffix training uses only 10 prompts; generalization to highly diverse harmful categories is not systematically ablated.
  • No evaluation against adaptive defenses (e.g., certified robustness, adversarial training targeting embedding space).

Relevance to Agentic AI / LLM Agents

LARGO directly challenges the safety guarantees of LLMs deployed as agentic backbones: if adversarial suffixes can be auto-generated in ~160s and appended to tool-call inputs, user queries, or retrieved context, they constitute a realistic injection attack surface for LLM agents operating in multi-step, tool-augmented pipelines. The paper also frames LARGO as "a potent alternative to agentic LLM prompting," positioning latent-space attacks as superior to the iterative LLM-attacker-as-optimizer paradigm (PAIR, AutoDAN) that agentic jailbreak research has converged on. For researchers tracking agent safety and red-teaming infrastructure, LARGO's self-reflective decoding technique—having the model interpret its own adversarial internals—is a novel inversion of the introspection mechanisms (SelfIE, LatentQA) being explored for agent transparency and steering.