RAID: Refusal-Aware and Integrated Decoding for Jailbreaking LLMs

TL;DR

This paper targets the vulnerability of large language models to jailbreaks by introducing RAID, a framework that integrates refusal-aware embedding regularization with coherence-preserving, critic-guided decoding. By relaxing discrete adversarial suffixes into continuous embeddings and jointly optimizing for restricted outputs, avoidance of refusal directions, and fluency, RAID produces suffixes that more reliably bypass safety filters with fewer queries. Empirical results on AdvBench across multiple open-source LLMs show RAID achieving state-of-the-art attack success rates and lower computational cost compared to existing white-box baselines. The findings emphasize the importance of embedding-space geometry in safety vulnerabilities and suggest directions for developing geometry-aware defenses and more robust decoding strategies.

Abstract

Large language models (LLMs) achieve impressive performance across diverse tasks yet remain vulnerable to jailbreak attacks that bypass safety mechanisms. We present RAID (Refusal-Aware and Integrated Decoding), a framework that systematically probes these weaknesses by crafting adversarial suffixes that induce restricted content while preserving fluency. RAID relaxes discrete tokens into continuous embeddings and optimizes them with a joint objective that (i) encourages restricted responses, (ii) incorporates a refusal-aware regularizer to steer activations away from refusal directions in embedding space, and (iii) applies a coherence term to maintain semantic plausibility and non-redundancy. After optimization, a critic-guided decoding procedure maps embeddings back to tokens by balancing embedding affinity with language-model likelihood. This integration yields suffixes that are both effective in bypassing defenses and natural in form. Experiments on multiple open-source LLMs show that RAID achieves higher attack success rates with fewer queries and lower computational cost than recent white-box and black-box baselines. These findings highlight the importance of embedding-space regularization for understanding and mitigating LLM jailbreak vulnerabilities.

Figures (6)

• Figure 1: Effect of adversarial suffixes on LLM outputs for harmful prompts.
• Figure 2: Refusal-aware triplet intuition. The anchor activation $\mathbf a$ (current suffix) is contrasted with a refusal region (red negatives, with mean $\mathbf r$) and its refusal-ablated counterpart $\mathbf p=\mathbf a-(\mathbf d^\top\mathbf a)\mathbf d$, where $\mathbf d$ is the refusal direction. The margin $m$ visualizes the separation encouraged by the triplet loss.
• Figure 3: Refusal-aware geometry. The anchor $\mathbf a$, refusal direction ${\mathbf d}$, projection $(\mathbf d^\top\mathbf a){\mathbf d}$, refusal-ablated vector ${\mathbf p}$, and refusal mean ${\mathbf r}$ are shown. The triplet distances $\|{\mathbf a}-{\mathbf p}\|_2$ and $\|\mathbf a-\mathbf r\|_2$.
• Figure 4: (Scenario 1) Attack Success Rate (ASR) on AdvBench across four LLMs. RAID outperforms baselines on average and achieves perfect ASR on four models. ASETF results for Guanaco-7B are unavailable.
• Figure 5: (Scenario 1) Average computation time per attack prompt on Llama-2-7B.