Skip to content

Best-of-N Jailbreaking

🕒 Published (v1): 2025-01-01 · Source: NeurIPS · Venue: NeurIPS 2025 · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

Best-of-N (BoN) Jailbreaking is a black-box automated red-teaming algorithm that repeatedly samples modality-specific augmentations of a harmful prompt until a frontier model produces a harmful response. It achieves high attack success rates (ASRs) across text, vision, and audio modalities on closed-source models including GPT-4o (89%) and Claude 3.5 Sonnet (78%) with N=10,000 samples. ASR as a function of N follows a power-law, enabling forecasting of adversarial risk at larger compute budgets.

Problem

Existing jailbreak methods are often gradient-dependent, require logprob access, are single-modal, or rely on complex iterative LLM-based optimization—limiting their applicability to closed-source, multi-modal frontier systems. There is no unified, scalable black-box framework that generalizes across text, vision, and audio modalities and quantifies the scaling behavior of jailbreak success.

Method

BoN Jailbreaking applies random combinations of modality-specific augmentations to a harmful request and queries the target model until a harmful response is produced or N samples are exhausted. Text augmentations include character scrambling, random capitalization, and character noising. Vision augmentations embed the harmful text as typography in images with randomized font, color, size, position, and background blocks. Audio augmentations modify speed, pitch, volume, and add speech/noise/music overlays to vocalized requests. A GPT-4o classifier with the HarmBench grader prompt scores each response; false positives are manually reviewed. Bootstrap resampling over observed success/failure trajectories estimates expected ASR across multiple trajectories without re-running the algorithm. The method requires no gradients, no logprobs, and no model-specific optimization. BoN can be composed with prefix jailbreaks (PrePAIR, MSJ) by prepending an optimized harmful-compliance prefix and augmenting both prefix and request.

Key Contributions

  • A simple, modality-agnostic black-box jailbreak algorithm that achieves ≥37% ASR on all ten frontier LLMs tested with N=10,000 text samples.
  • Extension to VLMs via typographic image augmentation and to ALMs via waveform augmentation, achieving up to 88% ASR (Claude 3 Opus vision) and 87% ASR (DiVA audio).
  • Empirical discovery that negative log ASR follows a power-law in N (−log(ASR) = aN^{−b}) across all modalities and models, enabling forecasting within 4.6% average error using 10× fewer samples.
  • Composition with prefix attacks (PrePAIR, MSJ) raises sample efficiency up to 250× (audio) and final ASR by up to 35%.
  • Mechanistic analysis showing BoN's effectiveness stems from input variance exploitation rather than specific augmentation patterns or model-specific weaknesses.

Results

  • Text: 89% ASR on GPT-4o, 78% on Claude 3.5 Sonnet, 50% on Gemini Pro, 37% on o1 (N=5,000), 52% on circuit-breaker-defended Llama-3-8B-RR, 67% on GraySwan Cygnet; outperforms PAIR by 33% and TAP by 39% on average.
  • Vision (VLMs): 88% ASR on Claude 3 Opus, 56% on GPT-4o, 67% on GPT-4o-Mini, 46% on Gemini Flash, 33% on Claude 3.5 Sonnet (N=7,200); consistently lower than text ASR on the same model (e.g., 87% text vs. 56% vision for GPT-4o at N=7,200).
  • Audio (ALMs): 87% on DiVA, 71% on GPT-4o Realtime API, 71% on Gemini Flash, 59% on Gemini Pro (N=7,200).
  • Composition: BoN+MSJ on Claude 3.5 Sonnet raises ASR from 69% to 89% text and improves sample efficiency 34×; BoN+prefix on Gemini Pro audio raises ASR from 59% to 87% with 222× average efficiency gain for Gemini models.
  • Forecasting: Power law fit at N=1,000 predicts N=10,000 ASR with 4.4% average error (text), 6.3% (vision), 2.5% (audio).
  • Augmentation necessity: BoN with augmentations outperforms resampling-only baselines by 3.5×–22× on text; vision baseline achieves 0% vs. BoN's 56% on Claude Sonnet.

Limitations

  • ASR for o1 (deliberative alignment) is lower (37%) and plateaus earlier, suggesting chain-of-thought safety reasoning provides meaningful resistance.
  • Successful jailbreaks are unreliable under resampling: at temperature 1, harmful responses are reproduced only ~30% (text), ~25% (vision), ~15% (audio) of the time, meaning BoN exploits stochasticity rather than finding robustly harmful prompt variants.
  • Classifier false positives cause premature termination for some models (Claude 3 Opus, Llama3), leading to underestimated ASR and power-law plateau artifacts without human grading.
  • Forecasting consistently underestimates ASR for models with high final ASR.
  • Costs scale with N; N=10,000 on reasoning models (o1) is prohibitively expensive, limiting evaluation to N=5,000.
  • The study uses a fixed HarmBench "standard" split (159 prompts) excluding copyright/contextual behaviors, so coverage of the full harm space is incomplete.

Relevance to Vision-Language Models

BoN Jailbreaking directly demonstrates that closed-source VLMs (GPT-4o, Claude 3 Opus/Sonnet, Gemini Pro/Flash) are vulnerable to a straightforward typographic image attack requiring no gradient access, achieving up to 88% ASR. The vision results reveal that image modality safety alignment is consistently weaker than text alignment on the same underlying model, underscoring that multi-modal extension is an unsolved safety problem. The power-law scaling behavior found in VLMs implies that increasing attacker compute budget predictably increases VLM jailbreak success, providing a principled framework for risk estimation. This work motivates VLM defenders to consider input variance and typographic attack surfaces explicitly, beyond adversarial perturbation methods that assume white-box access.