TACS: Trajectory-Aware Candidate Selection for LLM Jailbreak Suffix Optimization

• URL: http://arxiv.org/abs/2608.29564v2
• Date: Tue, 01 Sep 2026 03:40:32 GMT
• Title: TACS: Trajectory-Aware Candidate Selection for LLM Jailbreak Suffix Optimization
• Abstract summary: Gradient-based jailbreak suffix optimization methods update the suffix by retaining the candidate with the lowest current loss.<n>We show that candidates that look better under the current-step proxy often fail to produce better jailbreak outcomes later in the search.<n>We propose TACS, a trajectory-aware candidate selection framework for jailbreak suffix optimization.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Gradient-based jailbreak suffix optimization methods typically update the suffix by retaining the candidate with the lowest current loss. We show that this seemingly natural design is fundamentally myopic: candidates that look better under the current-step proxy often fail to produce better jailbreak outcomes later in the search, revealing a form of selection-stage reward hacking. This suggests that candidate selection, rather than candidate generation alone, is a hidden bottleneck in suffix optimization. To address this issue, we propose TACS, a trajectory-aware candidate selection framework for jailbreak suffix optimization. Instead of selecting candidates solely by their immediate loss, TACS augments per-step evaluation with a trajectory-aware proxy and stabilizes selection with reference-policy regularization and a discriminator-estimated chi-squared correction, encouraging choices that remain effective beyond the current step. Experiments on HarmBench show that TACS consistently outperforms strong baselines under the same search budget, substantially improving attack success rates while exhibiting more stable optimization behavior throughout the search. Our findings highlight that mitigating selection-stage reward hacking caused by myopic candidate selection is critical for improving jailbreak suffix optimization.

Related papers

• Breadth Beats Depth: Improving GCG-Based Jailbreak Optimization with Breadth-Oriented Suffix Search [7.070557270718812]
  optimization-based jailbreak attacks such as Greedy Coordinate Gradient (GCG) achieve strong effectiveness and transferability.<n>We propose BOSS, a plug-and-play framework that improves GCG-based jailbreak optimization through breadth-oriented suffix search.
  arXiv  Detail & Related papers  (2026-09-02T06:34:29Z)
• Learning Not to Optimize: Physics-Informed Action-Space Reshaping for Intent-Based Network Control [50.46501177871741]
  We show that LNOQRD reduces small-instance candidates by $75.9%$ while retaining $90.8%$ near-oracle coverage.<n>Experiments show that LNOQRD achieves the highest utility and intent satisfaction, the lowest hard-law violation and post-generation latency.
  arXiv  Detail & Related papers  (2026-08-02T00:27:01Z)
• JailbreakOPT: Tool-Assisted Iterative Jailbreak Prompt Optimization [6.473799439592539]
  JailbreakOPT is a tool-assisted framework for improving iterative single-turn jailbreak prompt optimization.<n>JailbreakOPT organizes diverse atomic jailbreak prompts into an attack tool library and composes them through a unified intra-episode optimization abstraction.<n> Experiments show that JailbreakOPT improves attack success rate (ASR) while reducing the number of attacks until success (No.A) compared with atomic single-turn attacks.
  arXiv  Detail & Related papers  (2026-06-09T20:22:29Z)
• Aligning Data-Driven Predictors with Allocation: A Decision-Focused Approach to Survival Analysis [52.10284705210197]
  We show that machine learning predictors can yield arbitrarily poor outcomes when used for allocation.<n>We introduce a decision-focused learning approach based on optimizing normalized discounted cumulative gain (NDCG)<n>We propose a bootstrapping approach to optimize the NDCG of existing survival models.
  arXiv  Detail & Related papers  (2026-06-01T12:03:22Z)
• F-GRPO: Factorized Group-Relative Policy Optimization for Unified Candidate Generation and Ranking [79.49893545611779]
  Large Language Models (LLMs) can generate a subset and order it within a single autoregressive pass.<n>This flexibility introduces a new optimization challenge: the model must search an output space while receiving utility feedback only after the full ranked list is generated.<n>This credit assignment gap makes end-to-end optimization unstable and sample-inefficient.<n>We propose a unified framework that performs both within a single autoregressive rollout and optimize them end-to-end via factorized group-relative policy optimization.
  arXiv  Detail & Related papers  (2026-05-13T04:52:33Z)
• TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Models [15.495882533240833]
  Large language models (LLMs) have achieved remarkable success across diverse applications but remain vulnerable to jailbreak attacks.<n>We propose TAO-Attack, a new optimization-based jailbreak method.<n> TAO-Attack consistently outperforms state-of-the-art methods, achieving higher attack success rates and even reaching 100% in certain scenarios.
  arXiv  Detail & Related papers  (2026-03-03T15:25:53Z)
• APAO: Adaptive Prefix-Aware Optimization for Generative Recommendation [26.371939617653084]
  Generative recommendation is an autoregressive generation process, predicting discrete tokens of the next item conditioned on user interaction histories.<n>Existing generative recommendation models are typically trained with token-level likelihood objectives, such as cross-entropy loss.<n>This leads to a training-inference inconsistency: standard training assumes ground-truth history is always available, ignoring the fact that beam search prunes low-probability branches during inference.
  arXiv  Detail & Related papers  (2026-03-03T08:29:15Z)
• Optimized Distortion in Linear Social Choice [28.227695590829086]
  We study distortion of linear social choice for deterministic and randomized voting rules.<n>We introduce poly-time instance-optimal algorithms for minimizing distortion given a collection of candidates and votes.
  arXiv  Detail & Related papers  (2025-10-22T20:42:49Z)
• A Principled Approach to Randomized Selection under Uncertainty: Applications to Peer Review and Grant Funding [61.86327960322782]
  We propose a principled framework for randomized decision-making based on interval estimates of the quality of each item.<n>We introduce MERIT, an optimization-based method that maximizes the worst-case expected number of top candidates selected.<n>We prove that MERIT satisfies desirable axiomatic properties not guaranteed by existing approaches.
  arXiv  Detail & Related papers  (2025-06-23T19:59:30Z)
• Uncertainty-Penalized Direct Preference Optimization [52.387088396044206]
  We develop a pessimistic framework for DPO by introducing preference uncertainty penalization schemes. The penalization serves as a correction to the loss which attenuates the loss gradient for uncertain samples. We show improved overall performance compared to vanilla DPO, as well as better completions on prompts from high-uncertainty chosen/rejected responses.
  arXiv  Detail & Related papers  (2024-10-26T14:24:37Z)
• Correcting the Mythos of KL-Regularization: Direct Alignment without Overoptimization via Chi-Squared Preference Optimization [78.82586283794886]
  $chi2$-Preference Optimization ($chi$PO) is an efficient offline alignment algorithm provably robust to overoptimization.<n>$chi$PO implements the principle of pessimism in the face of uncertainty via regularization.<n>$chi$PO's simplicity and strong guarantees make it the first practical and general-purpose offline alignment algorithm provably robust to overoptimization.
  arXiv  Detail & Related papers  (2024-07-18T11:08:40Z)
• Provably Mitigating Overoptimization in RLHF: Your SFT Loss is Implicitly an Adversarial Regularizer [52.09480867526656]
  We identify the source of misalignment as a form of distributional shift and uncertainty in learning human preferences.<n>To mitigate overoptimization, we first propose a theoretical algorithm that chooses the best policy for an adversarially chosen reward model.<n>Using the equivalence between reward models and the corresponding optimal policy, the algorithm features a simple objective that combines a preference optimization loss and a supervised learning loss.
  arXiv  Detail & Related papers  (2024-05-26T05:38:50Z)
• Non-Elitist Selection Can Improve the Performance of Irace [0.8258451067861933]
  We study two alternative selection methods for tuning ant colony optimization algorithms for traveling salesperson problems and the quadratic assignment problem. The experimental results show improvement on the tested benchmarks compared to the default selection of irace. In addition, the obtained results indicate that non-elitist can obtain diverse algorithm configurations, which encourages us to explore a wider range of solutions to understand the behavior of algorithms.
  arXiv  Detail & Related papers  (2022-03-17T10:34:30Z)
• Prophet: Proactive Candidate-Selection for Federated Learning by Predicting the Qualities of Training and Reporting Phases [66.01459702625064]
  In 5G networks, the training latency is still an obstacle preventing Federated Learning (FL) from being largely adopted. One of the most fundamental problems that lead to large latency is the bad candidate-selection for FL. In this paper, we study the proactive candidate-selection for FL in this paper.
  arXiv  Detail & Related papers  (2020-02-03T06:40:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.