LLM Jailbreaking Analysis

Compares how censored vs uncensored attacker models jailbreak target LLMs, classifies the strategies they use, and tests whether successful prompts transfer to other models.

Full write-up: See report.pdf for methodology, results, and analysis.

Requirements

• Python 3.10+
• NVIDIA GPU with CUDA (models run in 4-bit quantization)
• Hugging Face account with access to walledai/HarmBench dataset, and Meta-Llama-3-8B-Instruct, HarmBench-Mistral-7b-val-cls models

pip install -r requirements.txt

Setup

Set SAVE_PATH in utils.py to a directory where results and model caches will be stored:

SAVE_PATH = "/path/to/results/"

Research Questions

Run them in order. RQ2 and RQ3 depend on JSON output from RQ1.

python rq1_asr.py
python rq2_semantics.py
python rq3_transferrability.py

Models

Dataset: walledai/HarmBench (contextual split)

50 harmful behaviors, up to 10 PAIR-style refinement iterations each.

Results

RQ1: Attack Success Rate (Gemma-2-9B-it)

The censored attacker outperformed the abliterated model, contrary to the initial hypothesis.

RQ2: Semantic Strategies

The semantic strategies used in classified by a three LLM as a judge majority voting system. Both attackers rely heavily on Hypothetical Framing, but the censored model uses a more varied strategy mix overall.

All prompts generated

Successful jailbreaks only

Preference-over-Effectiveness (lower = more efficient)

Obfuscation and indirect elicitation produced zero successful jailbreaks for either attacker.

RQ3: Cross-Model Transferability (Qwen3.5-9B)

Direct attack (baseline on Qwen)

Transfer from Gemma-successful prompts

48 prompts (22 uncensored, 26 censored) transferred to Qwen3.5-9B with no refinement.

Transferred prompts outperformed both the original Gemma ASRs and the Qwen baseline, suggesting successful jailbreak prompts generalize across aligned models of similar scale.