DUALBREACH: Efficient Dual-Jailbreaking via Target-Driven Initialization and Multi-Target Optimization

DUALBREACH: Efficient Dual-Jailbreaking via Target-Driven Initialization and Multi-Target Optimization

Speakers: Xinzhe Huang

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=NmPGblC22R0

Overview

Presented by Johnny on behalf of the authors, DualBreach is a jailbreaking framework designed to bypass both external guardrails and internal LLM safety alignment simultaneously -- addressing the dual-defense architecture increasingly deployed in production AI systems. While existing jailbreak methods like GCG and PAP can bypass either guardrails or alignment individually, they fail against the combined defense. DualBreach achieves a jailbreak success rate of 64-95% across five mainstream LLMs including GPT-4 (91% ASR), requires only 2.4 average queries per success (3x more efficient than baselines), and in the most restrictive one-shot attack scenario achieves a 97% guardrail bypass rate against Llama Guard 3 and up to 76% dual jailbreak success across six safety-aligned models including Claude 3.5. The paper also proposes E-Guard, an ensemble defense that reduces attack success rates by up to 25%.

Background

▶ Watch: Dual defense problem: guardrails plus alignment block existing attacks (0:15)

LLM safety relies on two defense layers: internal safety alignment (RLHF training) and external guardrails (systems like Llama Guard, OpenAI's Moderation API) that filter inputs before they reach the model. Existing jailbreak attacks focus on one layer or the other. GCG uses gradient-based optimization to find adversarial suffixes that bypass alignment but produces unnatural tokens that guardrails easily flag. PAP (Persuasive Adversarial Prompts) uses academic framing to bypass guardrails but triggers the LLM's alignment refusal. CodeAttacks encodes requests in code to evade detection but remains detectable by pattern-based guardrails.

The problem is a joint optimization: the adversarial prompt must appear benign to external guardrails while remaining potent enough to trigger harmful generation from the aligned LLM. These two objectives are inherently contradictory, and existing single-target methods cannot balance them. Additionally, real-world APIs impose rate limiting and DOS defenses, meaning attacks must succeed in very few queries.

Key Findings

▶ Watch: Three-stage pipeline: TDI, proxy guardrail, multi-target optimization (4:00)

64-95% attack success rate: DualBreach achieves dominant jailbreak success across all five tested LLMs, with 91% against GPT-4 -- significantly outperforming all seven baselines.

2.4 queries per success: Nearly 3x more efficient than the next best baselines (RENELLM and CodeAttacks, both requiring 7+ queries), making the attack practical under real-world API rate limiting.

97% one-shot guardrail bypass: In the most restrictive scenario (single query attempt), DualBreach achieves 97% bypass rate against Llama Guard 3, compared to 66% for RENELLM and 22% for other baselines.

76% one-shot dual jailbreak: Even with a single query, DualBreach achieves up to 76% success against six safety-aligned models including Claude 3.5 and GPT-4 -- most existing methods cannot generate prompts benign enough for strong guardrails at all.

Output guardrail resilience: When Llama Guard 3 is applied to both inputs and outputs of GPT-4, DualBreach maintains 90% success with only 3.2 queries per prompt.

E-Guard ensemble defense: A proposed countermeasure that aggregates multiple guardrails through boosting reduces GCG's success from 36% to 9% and CodeAttacks from 55% to 30%, achieving up to 25% reduction across baselines.

Technical Deep Dive

▶ Watch: Data distillation: BLEU diversity and K-means for efficient proxy training (8:00)

DualBreach operates in three stages. Stage 1: Target-Driven Initialization (TDI) transforms direct harmful queries into contextually plausible prompts through reverse reasoning. An auxiliary LLM finds a prompt that maximizes the probability of the target harmful output while enforcing plausibility constraints -- wrapping malicious intent (e.g., assassination instructions) into benign contexts (e.g., hypothetical counter-terrorism strategy analysis). This creates an initial prompt that can pass cursory guardrail inspection.

Stage 2: Proxy Guardrail Training addresses the black-box nature of production guardrails. Since gradient-based optimization requires differentiable models, DualBreach trains a proxy guardrail to approximate the behavior of real guardrails like Llama Guard 3. To minimize API queries (which are expensive and trigger rate limiting), data distillation uses BLEU-based diversity selection and K-means clustering to select the most representative prompts for training, achieving comprehensive semantic coverage with minimal query overhead.

Stage 3: Multi-Target Optimization (MTO) is the core engine. A single differentiable loss function simultaneously optimizes the prompt against both the proxy guardrail and a surrogate LLM. The optimization uses a push-pull mechanism: "pushing" the prompt representation toward harmful completion prefixes (e.g., "Sure, I can help you with that") while "pulling" away from refusal patterns (e.g., "I'm sorry, I cannot fulfill this request"). Gradients from both the proxy guardrail and the surrogate LLM are combined to update the prompt representation.

The evaluation covers three benchmarks (AdvBench, AIA, HarmBench), five guardrails, five LLMs (Llama 2, GPT-2, ChatGPT, GPT-4, Gemini), and uses high-fidelity judges (Pateya-4M, GPT-4) on the StrongReject benchmark for generalization testing.

Demo / Proof of Concept

▶ Watch: Results: 91% ASR against GPT-4, 2.4 queries per success (10:00)

A blackmail scenario case study demonstrates how existing methods fail at different stages: GCG and CodeAttacks are flagged by guardrails due to unnatural tokens; PAP bypasses guardrails but triggers alignment refusal. DualBreach succeeds against both layers. The StrongReject benchmark evaluation with high-fidelity judges confirms consistent 62-67% ASR, outperforming all baselines by wide margins.

Defensive Implications

▶ Watch: E-Guard defense: ensemble guardrails reduce success by up to 25% (14:00)

The paper proposes E-Guard as a mitigation: an ensemble of multiple guardrails combined through a boosting-based aggregation. Single guardrails have inherent coverage gaps that advanced attacks like DualBreach exploit. E-Guard reduces attack success by up to 25% across all baselines, with specific improvements including GCG from 36% to 9% and CodeAttacks from 55% to 30%. The broader implication is that production AI safety requires defense-in-depth with diverse, independently designed guardrail components rather than reliance on any single detection model.

Key Takeaways

• Production LLM safety relies on dual defense (guardrails + alignment), but DualBreach bypasses both with 91% success against GPT-4
• Only 2.4 queries per success on average -- 3x more efficient than alternatives, practical under real API rate limiting
• One-shot attacks achieve 76% dual jailbreak success and 97% guardrail bypass against Llama Guard 3
• The push-pull optimization simultaneously drives prompts toward harmful completions and away from refusal patterns
• Proposed E-Guard ensemble defense reduces attack success by up to 25% through multi-guardrail boosting
• All existing single-target jailbreak methods fail against dual-defense architectures

About the Speaker(s)

Johnny presented on behalf of the paper's authors, Xinzhe Huang et al. The research focuses on evaluating and improving the robustness of LLM safety mechanisms, contributing both offensive techniques for red-teaming and defensive proposals for hardening production AI systems.