Understanding Jailbreak Transfer

This repository contains the code and reproducibility artifacts for the paper Toward Understanding the Transferability of Adversarial Suffixes in Large Language Models. It is intended to be the entry point for reproducing the paper workflow: suffix generation, dataset construction, completion generation, jailbreak-judge evaluation, activation regeneration, and analysis.

Published JSON artifacts live in Git as chunked files with manifests. Large activation tensors are not committed; the commands to regenerate activations are documented in docs/activations.md.

For a step-by-step guide to reproducing the paper results, start with the recommended Slurm job-array workflow in docs/slurm_workflow.md. Slurm is the recommended way to parallelize prompt and chunk jobs for full paper-scale reproduction. docs/workflow.md provides the local-command equivalent for reference, but it has not been tested end to end.

Table of Contents

• Start Here
• Workflow Summary
• Repository Layout

Start Here

Read the docs in this order if you are reproducing results for the first time:

Workflow Summary

This table provides an overview of what to run, in what order, what checkpoint or saved output to expect, and the relevant paper sections. For the detailed section-by-section mapping between the files in the repo and the sections in the paper, use docs/paper_map.md.

Path shorthand:

• <output-dir>: usually data/multiple_seed_results.
• <artifact-dir>: usually <output-dir>/$MODEL_ALIAS/transfer/${MODEL_ALIAS}_multiple_seed_results_transfer.

The recommended command-by-command workflow is in docs/slurm_workflow.md. The local-command equivalent is in docs/workflow.md, but it is provided as an untested reference rather than the primary reproduction path.

Repository Layout

understanding_jailbreak_transfer/
  README.md                         Project entry point and doc index.
  environment.yml                   Conda environment used for reproduction.
  configs/                          Example model, path, and Slurm settings.
    models.example.yaml             Model IDs used in the experiments.
    paths.example.yaml              Cache/output path placeholders.
    slurm.example.yaml              Cluster setting placeholders.
    gcg_push_paper.example.yaml     Config-driven GCG-push paper experiment.
    gcg_push_20_random_indices.txt  Prompt IDs used for the paper GCG-push runs.
  data/                             Versioned artifacts used by the paper workflow.
    processed/                      JailbreakBench prompts and suffixes as chunked JSON.
    multiple_seed_results/          Multi-seed no-transfer and transfer artifacts.
                                      Commit only chunks/ and manifest.json; generation_chunks/,
                                      evaluation_chunks/, and combined.json are temporary.
    gcg_results/raw/                Raw per-prompt/per-seed GCG result JSON files.
    gcg_push_results/               Coefficient-modified GCG-push artifacts by intervention.
    refusal_directions/             Stored refusal-direction vectors and metadata.
  docs/                             Reproducibility guide and reference docs.
  external/                         Small support files for external repositories.
    refusal_direction_model_utils/  Model wrappers to copy into the external refusal-direction repo.
  pipeline/                         Python pipeline modules.
    suffix_generation/              GCG runner plus dataset creation/checking.
    generation/                     Completion generation.
    evaluation/                     Jailbreak-judge evaluation and label normalization.
    activations/                    Activation regeneration and export utilities.
    analysis/                       Multi-seed analysis.
    cross_model/                    Cross-model setup, generation, evaluation, and analysis.
    gcg_push/                       Config-driven altered-GCG runner, artifact builder, launcher, and analysis.
    prompt_rephrasings/             Prompt-rephrasing dataset setup.
    model_utils/                    Model wrappers used by this repository.
  scripts/                          Local and Slurm convenience wrappers.
  tools/                            Artifact chunking, combining, checksum, and tensor utilities.