Skip to content

Back to the catalog

GAS-Leak-LLM: Genetic Algorithm-Based Suffix Optimization for Black-Box LLM Jailbreaking
arxiv.orgpaper

GAS-Leak-LLM: Genetic Algorithm-Based Suffix Optimization for Black-Box LLM Jailbreaking

GAS-Leak-LLM is a black-box jailbreaking attack that uses a genetic algorithm (selection, mutation, crossover) to evolve adversarial suffixes appended to prompts, bypassing LLM safety alignment without needing model weights or gradients. The paper reports empirical results showing existing content-moderation and alignment safeguards on commercial LLMs can be defeated through this iterative, query-only search over the discrete prompt space.

TL;DR A genetic-algorithm approach evolves adversarial suffixes to jailbreak LLMs in a pure black-box setting.
Open original ↗
Document

What it is

GAS-Leak-LLM is a black-box, query-only jailbreak that evolves a universal adversarial suffix via a genetic algorithm. The summary covers the GA-over-suffixes mechanism; what it omits are the paper's three empirical findings and the specific fitness design that a defender can act on. The paper is a 2026 arXiv preprint (cs.CR) from Cochin University of Science and Technology and University of Pavia.

Findings the summary omits

The paper reports three concrete results about what makes suffix attacks work — directly useful for prioritizing defenses:

  • Semantically meaningful suffixes beat meaningless ones. Coherent, contextually relevant word-suffixes induce jailbreaks substantially more often than random token strings. This distinguishes the approach from GCG-style gibberish suffixes and means perplexity/gibberish filters won't catch these.
  • **Suffix length is a critical determinant, and longer suffixes hit robust models harder.** More capable/aligned baselines (the Llama family is named) become more vulnerable as suffix length grows.
  • Instruction fine-tuning materially strengthens alignment, reducing baseline susceptibility — offered as the one lever that measurably helped.

How the attack works

The fitness function is the notable engineering detail. For each candidate suffix appended to sampled harmful prompts:

  1. The response is scanned for refusal phrases ("I can't help with that", "I cannot assist with", "I'm not able to provide"). A match assigns fitness = −1 (failed jailbreak).
  2. Non-refusals are scored by a CrossEncoder (SentenceTransformers) as similarity(response, target) − similarity(response, rejection), averaged over the sampled prompts. Higher = closer to the desired harmful output and farther from refusal.

Meaningful suffixes are generated by feeding sampled English words to an LLM with a system prompt that emits a single <sentence>...</sentence>; meaningless ones are sampled from a Qwen (0.6B) token vocabulary. Parents are chosen by tournament selection; standard crossover/mutation/replacement follow.

Caveats

  • The fetched text cuts off during the Selection section — no attack-success-rate numbers for GAS-Leak-LLM itself are present. The ">90% ASR on GPT-4 and Claude" figures in the text are cited related work (GCG/universal-suffix papers), not this method's results.
  • Scale is small: population size M = 10, and fitness is evaluated on a random subset of n prompts "due to hardware constraints." Treat the findings as directional rather than benchmarked from this excerpt.
  • The refusal-detection stage keys on a fixed English rejection-phrase list, so results depend on the target's refusal wording.

For defenders: don't rely on gibberish/perplexity filters (meaningful suffixes evade them), and don't assume a stronger base model is safer against length-scaled suffixes — the paper claims the opposite for Llama-class models.

Technologies named here

Techniques named here

Related in AI Security