@inproceedings{yang-etal-2025-guiding,
    title = "Guiding not Forcing: Enhancing the Transferability of Jailbreaking Attacks on {LLM}s via Removing Superfluous Constraints",
    author = "Yang, Junxiao  and
      Zhang, Zhexin  and
      Cui, Shiyao  and
      Wang, Hongning  and
      Huang, Minlie",
    editor = "Che, Wanxiang  and
      Nabende, Joyce  and
      Shutova, Ekaterina  and
      Pilehvar, Mohammad Taher",
    booktitle = "Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)",
    month = jul,
    year = "2025",
    address = "Vienna, Austria",
    publisher = "Association for Computational Linguistics",
    url = "https://preview.aclanthology.org/ingestion-acl-25/2025.acl-long.965/",
    pages = "19643--19655",
    ISBN = "979-8-89176-251-0",
    abstract = "Jailbreaking attacks can effectively induce unsafe behaviors in Large Language Models (LLMs); however, the transferability of these attacks across different models remains limited. This study aims to understand and enhance the transferability of gradient-based jailbreaking methods, which are among the standard approaches for attacking white-box models. Through a detailed analysis of the optimization process, we introduce a novel conceptual framework to elucidate transferability and identify superfluous constraints{---}specifically, the response pattern constraint and the token tail constraint{---}as significant barriers to improved transferability. Removing these unnecessary constraints substantially enhances the transferability and controllability of gradient-based attacks. Evaluated on Llama-3-8B-Instruct as the source model, our method increases the overall Transfer Attack Success Rate (T-ASR) across a set of target models with varying safety levels from 18.4{\%} to 50.3{\%}, while also improving the stability and controllability of jailbreak behaviors on both source and target models."
}