Adversarial Déjà Vu: Jailbreak Dictionary Learning for Stronger Generalization to Unseen Attacks

TL;DR

The paper reframes robustness to jailbreaks as a problem of compositional generalization over a finite set of transferable adversarial skills. It formalizes the Adversarial Déjà Vu hypothesis and builds a Jailbreak Dictionary via dictionary learning to capture recurring skills across past attacks. ASCoT trains on diverse compositions of these primitives, improving generalization to unseen, including multi-turn, jailbreaks, without excessive refusals. The results underscore the importance of skill coverage and compositional depth over mere data scale, offering a scalable path to defending against novel adversaries.

Abstract

Large language models remain vulnerable to jailbreak attacks that bypass safety guardrails to elicit harmful outputs. Defending against novel jailbreaks represents a critical challenge in AI safety. Adversarial training -- designed to make models robust against worst-case perturbations -- has been the dominant paradigm for adversarial robustness. However, due to optimization challenges and difficulties in defining realistic threat models, adversarial training methods often fail on newly developed jailbreaks in practice. This paper proposes a new paradigm for improving robustness against unseen jailbreaks, centered on the Adversarial Déjà Vu hypothesis: novel jailbreaks are not fundamentally new, but largely recombinations of adversarial skills from previous attacks. We study this hypothesis through a large-scale analysis of 32 attack papers published over two years. Using an automated pipeline, we extract and compress adversarial skills into a sparse dictionary of primitives, with LLMs generating human-readable descriptions. Our analysis reveals that unseen attacks can be effectively explained as sparse compositions of earlier skills, with explanatory power increasing monotonically as skill coverage grows. Guided by this insight, we introduce Adversarial Skill Compositional Training (ASCoT), which trains on diverse compositions of skill primitives rather than isolated attack instances. ASCoT substantially improves robustness to unseen attacks, including multi-turn jailbreaks, while maintaining low over-refusal rates. We also demonstrate that expanding adversarial skill coverage, not just data scale, is key to defending against novel attacks. \textcolor{red}{\textbf{Warning: This paper contains content that may be harmful or offensive in nature.

Figures (7)

• Figure 1: (a) Monthly growth of jailbreaks. (b) Recurrence of adversarial skills across attacks.
• Figure 2: Overview of our evaluation pipeline for the Adversarial Déjà Vu phenomenon. Seen attack prompts (left) are used for LLM-based adversarial skill extraction and dictionary learning, producing a compact set of skill primitives—the Jailbreak Dictionary. Skills from unseen, post-cutoff attacks (right) are then reconstructed via LLM-augmented basis pursuit over this dictionary. High-fidelity matches between unseen skills and existing primitives demonstrate that most new jailbreaks are recompositions of previously observed adversarial skills.
• Figure 3: Explainability Scores (1-5) of unseen jailbreaks over time. As more attacks are seen, the Jailbreak Dictionary explains new ones with higher fidelity, eventually plateauing—evidence that most “new” jailbreaks recombine existing adversarial skills.
• Figure 4: Example of adversarial skill composition used in ASCoT. Two primitives—executable_code_request (blue) and authority_narrative_priming (orange)—are combined to mutate a harmful base query into a rewritten adversarial query.
• Figure 5: (a) Expanding adversarial skill coverage yields a coverage dividend: harmfulness steadily decreases as more primitives are included in training. (b) Robustness depends on compositional depth: shallow training best defends against shorter, low-skill attacks (e.g., PAIR), while deeper training is required for longer, multi-skill attacks (e.g., AutoDAN-Turbo)