Year: 2026
Type: conference-paper
Abstract: Jailbreak attacks manipulate Large Language Models to generate harmful responses they are designed to avoid. Greedy Coordinate Gradient (GCG) has emerged as a general and effective approach that optimizes tokens in a suffix to generate jailbreakable prompts. However, GCG and its variants rely on fixed-length suffixes, and potential redundancy within these suffixes remains unexplored. We propose Mask-GCG, a plug-and-play method employing learnable token masking to identify impactful tokens within the suffix. Our approach increases update probability for high-impact tokens while pruning low-impact ones. This reduces redundancy, decreases gradient space size, and lowers computational overhead, shortening attack time. We evaluate Mask-GCG by applying it to the GCG and several improved variants. Experimental results show that most tokens in the suffix contribute significantly to attack success, and pruning a minority of low-impact tokens does not affect the loss values or compromise the attack success rate (ASR), thereby revealing token redundancy in LLM prompts. Our findings provide insights for developing efficient and interpretable LLMs from the perspective of jailbreak attacks.
Authors: Junjie Mu, Zonghao Ying, Zhekui Fan, Zonglei Jing, Yaoyuan Zhang, Zhengmin Yu, Wenxin Zhang, Quanchen Zou, Xiangzheng Zhang
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W4415055556
FWCI:
Cites:
Cited by:
Related to: