{"id":"ee046f47-e1af-4603-9078-502502132603","arxiv_id":"2504.19019","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":6,"one_line_summary":"GoAT, a graph-of-thoughts jailbreak method, reports improved black-box attack success against aligned LLMs compared with PAIR and TAP.","lead":"The paper describes GoAT, a black-box jailbreak method that uses graph-based reasoning to craft prompts that bypass LLM safety filters. It reports higher success rates than earlier attack methods, such as 20% versus 4% on Llama2-7B, while using fewer queries to the target model.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Table 2a and Table 2b report irreconcilable Claude-3 results for the identical GoAT configuration (68% ASR with 109.3 queries vs. 12% ASR with 35.9 queries), so the headline Claude-3 superiority over TAP is unsupported until this discrepancy is resolved.","rationale":"The reader's weakest_assumption focused on the GPT-4 evaluator's validity and the inconsistently described human-check protocol. My stress-test identifies an even more concrete problem: the paper's own tables contradict each other on the key Claude-3 result. Table 2a and Table 2b both purport to describe GoAT with the same Vicuna-13B Prompt Generator, yet they report 68% vs. 12% success and 109.3 vs. 35.9 queries on Claude-3. Since the claimed improvement over TAP on Claude-3 (68% vs. 60%) is a central pillar of the abstract and Section 4.2, this internal inconsistency is load-bearing. It is directly checkable by reproduction, unlike the evaluator-bias hypothesis which would require constructing a human-labeled gold set. The reader did mention the table contradiction in the rationale, but not as the weakest assumption, hence 'partial' agreement. The evaluator-protocol inconsistency remains a serious secondary concern: Section 3.2 and Appendix A.2 describe different human-annotation triggers, and no raw response-level data or human annotation counts are provided to resolve which protocol was actually used. Hyperparameter tuning on a 20-example subset of the same benchmark (Appendix A.4) also risks selection bias, though it is secondary to the table contradiction. Given the contradiction, the reported numbers cannot be taken at face value, and the central claim that GoAT improves on state-of-the-art black-box attacks is not currently supported. The reader's REJECT verdict is appropriate; no adjustment is needed.","tokens_in":24245,"tokens_out":5510,"duration_ms":51256,"concrete_test":"Re-run GoAT exactly as specified in Section 4.1 with Vicuna-13B as Prompt Generator, GPT-4 as Filter and Evaluator, hyperparameters B=3, h=3, d=10, N=10, on the same 50-goal AdvBench subset, targeting Claude-3, and report the jailbreak success rate and average query count using a precisely stated human-check protocol. If the reproduced ASR is approximately 68% with ~109 queries, Table 2b is erroneous and the Claude-3 claim may stand; if it is approximately 12% with ~36 queries, the headline comparison against TAP on Claude-3 is invalid and the paper's central claim fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central empirical claim that GoAT outperforms TAP on Claude-3 rests on Table 2a, which reports a 68% jailbreak success rate with 109.3 average queries for GoAT using Vicuna-13B as Prompt Generator. However, Table 2b, whose Vicuna row is explicitly the same configuration ('We used a simpler Prompt Generator in Table 2a'), reports 12% success and 35.9 queries for the same setup on Claude-3. These two numbers cannot both be correct. If the true Claude-3 success rate is approximately 12%, then GoAT is not superior to TAP (reported at 60% in Table 2a) on that target, and the claim of improved closed-source performance loses one of its two headline demonstrations. The discrepancy is not limited to one cell: the average query count also changes from 109.3 to 35.9, suggesting a different experimental run or evaluation protocol, not a mere typographical error in a percentage. Additionally, the human-check protocol is described inconsistently: Section 3.2 says three humans are consulted only when the Evaluator LLM's judgment is not high-confidence, while Appendix A.2 says all non-refusal responses are assessed by three human annotators with majority voting. This ambiguity further undermines confidence in the reported success rates. The internal contradiction in the main results table is the most direct, falsifiable threat to the central claim.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Graph of ATtacks (GoAT), a black-box jailbreak method that adapts the Graph of Thoughts framework to adversarial prompt generation. GoAT maintains a graph of reasoning paths over the conversation between a Prompt Generator and a target LLM; a Filter prunes candidate prompts, an Evaluator judges whether the target's response satisfies the harmful goal, and the Adversary decides which conversational information to retain. The method is evaluated on Vicuna-7B, Llama2-7B, GPT-4, and Claude-3, and compared with PAIR, TAP, and GCG. The authors report that GoAT achieves up to five times the success rate of TAP on Llama2-7B, higher success on GPT-4 and Claude-3, and lower query counts, while generating human-readable prompts. The paper also includes a code repository link and a responsible disclosure statement.","tokens_in":24614,"tokens_out":7554,"duration_ms":62770,"significance":"If the empirical claims held, GoAT would be a useful contribution to LLM red-teaming: it is fully black-box, produces interpretable prompts, and attempts to reduce redundant queries by aggregating information across reasoning paths. The paper is also transparent about its computational costs and limitations, and it ships a code link, which supports reproducibility. However, the central performance claims are not currently substantiated because the main results table contains a direct internal contradiction, the hyperparameters were tuned on the evaluation set, and the evaluation protocol for the success-rate metric is described inconsistently. These issues affect the headline comparisons with TAP and PAIR, so the significance of the contribution cannot be assessed from the reported data.","major_comments":[{"comment":"The reported Claude-3 results for the same GoAT configuration are irreconcilable. Table 2a lists GoAT (with Vicuna as Prompt Generator) at 68% success with 109.3 average queries on Claude-3, while Table 2b's Vicuna row, which the caption describes as the same setup ('We used a simpler Prompt Generator in Table 2a'), lists 12% success with 35.9 average queries. These numbers cannot both be correct for the identical configuration, and the discrepancy also affects the query counts, which differ by roughly a factor of three. Because the paper's claim of outperforming TAP on Claude-3 depends entirely on the 68% figure (TAP is reported at 60%), the central empirical claim is unsupported until the authors explain which number is correct and why the two tables disagree.","section":"Table 2a vs Table 2b"},{"comment":"Hyperparameters were tuned on the evaluation set. Appendix A.4 states that B, h, and d were optimized on 'a randomly selected subset of 20 examples from our dataset' and that the resulting configuration (B=3, h=3, d=10) 'was used in all our experiments.' The final reported success rates are computed on the 50-goal AdvBench subset from which this tuning subset is drawn, so the reported numbers are not obtained on a held-out test set. This selection on the evaluation data inflates the reported attack success rates and gives GoAT an unfair advantage over baselines that did not receive the same tuning. The authors should tune on a separate development set or report a model-selection procedure that is independent of the test goals.","section":"Appendix A.4"},{"comment":"The human-check protocol is described inconsistently. Section 3.2 states that three humans are consulted only 'whenever the Evaluator LLM's judgment is not with high confidence,' whereas Appendix A.2 states that 'we ultimately assessed the harmfulness of all other responses using three human annotators, with the final results determined by majority voting.' These two procedures will in general yield different success rates, and because the success rate is the paper's central metric, the authors must specify exactly which protocol was used and report human-annotation results or agreement statistics. Without this, the validity of the Evaluator, and hence of every reported success rate, is not firmly established.","section":"Section 3.2 and Appendix A.2"},{"comment":"The parameter-tuning experiments in Table 4, run with GPT-3.5-Turbo as Filter and Evaluator and Vicuna-7B as Target, report a success rate of 35% for the configuration B=3, h=3, d=10, yet Table 2a reports a 98% success rate for the same target model with the same graph configuration. The only apparent difference is the switch to GPT-4 for Filter and Evaluator. This extreme sensitivity to the attacker-side evaluation model should be quantified and discussed; otherwise the reported gains may be driven by the choice of Evaluator rather than by the graph-based reasoning that is the paper's claimed contribution.","section":"Table 4 vs Table 2a"}],"minor_comments":[{"comment":"The phrase 'apple for apple' should be 'apples to apples'.","section":"Appendix A.1"},{"comment":"The sentence 'We used a simpler Prompt Generator in Table 2a, and that makes our attacks stronger, as more advanced models are more expensive to run' is confusing and appears to contradict the comparison intended by the table; please clarify which Prompt Generator was used for each row and why a simpler generator is said to make attacks stronger.","section":"Table 2b caption"},{"comment":"The sentence 'The weaker LLMs we use in these roles the stronger an attack is' is grammatically incomplete and logically unclear; please rephrase it.","section":"Section 3.2"},{"comment":"The parameter d is described both as a 'maximum graph diameter' in the algorithm's Require list and as the number of top leaves kept on line 14; the relation between these two notions should be clarified.","section":"Algorithm 1"},{"comment":"The GCG row reports '256K' for query counts, but the text in Appendix A.2 notes that this number reflects optimization steps rather than direct LLM queries; this distinction should be indicated in the table itself.","section":"Table 2a"}],"recommendation":"reject","confidential_remarks":"The direct contradiction between Table 2a and Table 2b for the Claude-3 results is, on its own, sufficient to call the reliability of the experimental reporting into question. The tuning-on-evaluation-set issue compounds this. Should the authors resubmit, they should be required to provide raw logs, a clear experimental protocol, and a clean train/test split, and to report which of the two Claude-3 numbers is correct."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Have you looked at the GoAT jailbreak paper? You should know: the headline empirical claim doesn't survive contact with its own tables. Table 2a reports GoAT at 68% ASR on Claude-3 with Vicuna-13B as prompt generator; Table 2b, which the caption says uses the same Vicuna generator, reports 12% on Claude-3 for the same setup. Those can't both be right. If the 12% is the real number, GoAT is worse than TAP (60% in Table 2a) on Claude-3, and the closed-source improvement evaporates. That's a load-bearing problem, not a footnote.\n\nWhat is genuinely new: GoAT is a graph-structured variant of TAP. The idea of letting attack paths share progress and combine nodes via a minimum-spanning-tree heuristic is a reasonable step beyond tree-of-thoughts, and the paper shows a nice qualitative example of cross-path aggregation. The prompts are human-readable, and the authors compare against PAIR, TAP, and GCG, and they disclose concurrent GAP and H-CoT. They also include a limitations section and responsible disclosure. That part is fine.\n\nThe soft spots beyond the table contradiction: (1) Hyperparameters B, h, d were tuned on a 20-goal sample drawn from the same 50-goal AdvBench subset used for the final numbers. That's selection on the evaluation set, disclosed in Appendix A.4, but it still inflates the reported success rates. (2) The success evaluator is GPT-4 with a human-check protocol described differently in Section 3.2 (humans only for low-confidence judgments) and Appendix A.2 (all non-refusal responses judged by three human annotators). Ambiguity in the judge undermines all ASR numbers. (3) The caption sentence about 'simpler Prompt Generator' in Table 2 is confusing; I read it as an editing error, but it contributes to the mystery of the Claude-3 discrepancy.\n\nWho is this for? Red-teamers and robustness researchers might find the graph-sharing idea worth experimenting with, and the qualitative example is instructive. But as submitted, the evaluation cannot be trusted. A serious referee should ask for a corrected, consistent set of tables, a clear evaluator protocol, and ideally a re-run with held-out tuning. I'd send it to review rather than desk-reject — the idea is worth engaging — but with an expectation of major revision.","headline":"The graph-based jailbreak idea is worth a look, but the paper's own tables contradict each other on the key Claude-3 result, so the central empirical claim is unsupported as written.","tokens_in":25120,"tokens_out":3691,"would_cite":false,"duration_ms":33786,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A graph of attack attempts, instead of a chain or tree, lifts black-box jailbreak success on Llama2-7B from 4% to 20% and beats prior attacks on GPT-4 and Claude-3.","keywords":["jailbreak attacks","large language models","black-box attack","graph of thoughts","adversarial prompts","LLM safety","red teaming","human-readable prompts"],"falsifier":"Take the exact 50-goal AdvBench subset used in the paper, rerun GoAT, PAIR, and TAP against Llama2-7B and Claude-3, and have independent human annotators label every response as harmful or not without seeing which method produced it. If the human-verified success rates do not reproduce GoAT's margins over PAIR and TAP on both models, the central claim of superiority fails; a second, cheaper check is to verify whether every prompt GoAT labels successful actually starts with harmful content rather than a refusal followed by safe information.","tokens_in":24076,"feed_emoji":"🔓","tokens_out":7916,"duration_ms":70151,"temperature":0.7,"pith_summary":"This paper proposes Graph of Attacks (GoAT), a black-box method for jailbreaking large language models that arranges the attacker's reasoning as a graph instead of a single chain or tree. The central claim is that letting separate attack paths see and merge each other's partial progress finds successful human-readable prompts more often and with fewer queries to the victim model than the leading black-box baselines PAIR and TAP. On a 50-goal subset of AdvBench, GoAT reportedly lifts success on Llama2-7B from 4% to 20% and on Claude-3 from 60% to 68%, while generating prompts a human reader can follow. A sympathetic reader should care because the result suggests black-box red teaming does not have to choose between interpretability, query efficiency, and effectiveness against strongly aligned models. The reported gains depend on an automated evaluator's judgement of success, so the exact margins are only as solid as that judge.","feed_headline":"Graph attack lifts Llama jailbreaks from 4% to 20%","feed_subtitle":"Black-box, human-readable prompts also beat prior attacks on GPT-4 and Claude-3 with fewer queries.","key_machinery":"The load-bearing object is the GoAT reasoning graph: a directed graph whose nodes are prompt-response exchanges between the prompt generator and the target model, with edges recording which earlier exchanges informed each later candidate. The iterative loop has four roles—prompt generator, filter, evaluator, and adversary—and each iteration expands the graph by generating B candidate prompts per node from a local subgraph of depth h, keeping only candidates whose filter score clears a relevance threshold, taking the top d leaves as new nodes, and having the target respond to them. The innovation is aggregation: because the conversational history passed to the prompt generator is a subgraph rather than a single path, the next candidate can combine reasoning from multiple branches at once. The paper illustrates this with a node that merges a hypothetical-future framing, a roleplay framing, and an emotional-appeal framing into the prompt that finally makes Llama2-7B comply.","core_discovery":"The paper's central discovery is that graph-structured reasoning materially improves black-box jailbreaking. In GoAT, an attacker team maintains a directed graph of prompt-response interactions; each new candidate prompt is generated from a recent subgraph of that history, filtered for relevance to the attack goal, sent to the target model, and scored by an evaluator. Only the most promising branches become new nodes, and later candidates draw on the combined history of several nodes at once, so a tactic that failed in one branch can still contribute wording or framing that succeeds when merged with insights from other branches. The authors' own worked example shows nodes 4, 5, and 7, each insufficient on its own, converging into node 9's winning prompt. This cross-path synthesis, rather than any single prompt template, is what the paper claims delivers the improved success rates and lower query counts.","pith_inferences":["The paper does not pursue this, but the same graph-of-attempts mechanism could be turned into an interpretable red-teaming audit for other safety properties, such as bias, privacy leakage, or tool misuse, where each branch records which tactic failed and why.","If the advantage comes from cross-path aggregation rather than from the specific LLM components, then the attack should be reproducible with cheaper evaluator and filter models; a direct ablation of the aggregation step versus the evaluator choice would separate these effects.","The Mixtral-vs-Vicuna jump (20% to 62% on Llama2-7B) suggests that scaling the attacker's prompt generator is a cheap lever, and one testable extension is whether a stronger open generator closes the remaining gap on Claude-3 without query growth.","The paper's graph also makes a natural defense target: a defender could monitor graph convergence, many branches converging on one obfuscation pattern, as a signature of this attack, something tree-based attacks would not expose."],"forward_implications":["GoAT increases jailbreak success on Llama2-7B from 4% (TAP) and 0% (PAIR) to 20%, using fewer average queries to the victim model.","GoAT reaches 94% on GPT-4 and 68% on Claude-3, beating TAP (90%, 60%) and PAIR (60%, 24%) in the same black-box setting.","All generated prompts remain human-readable, in contrast to token-level attacks like GCG, so defenders can inspect exactly which phrasing bypassed safety.","With a stronger prompt generator (Mixtral in place of Vicuna), GoAT raises Llama2-7B success to 62%, showing generator capability is a major performance lever.","The graph structure prevents redundant exploration: separate attack branches that fail can still contribute partial insights to a later merged prompt."],"supporting_citations":[{"why":"Supplies the Graph of Thoughts reasoning framework that GoAT adapts to adversarial prompt generation.","marker":"[Besta et al., 2024]"},{"why":"Defines PAIR, the chain-of-thought black-box baseline whose success rates GoAT must beat and whose attacker-team structure GoAT extends.","marker":"[Chao et al., 2023]"},{"why":"Defines TAP, the tree-based black-box baseline that GoAT improves on by allowing cross-path sharing of progress.","marker":"[Mehrotra et al., 2024]"},{"why":"Introduces the AdvBench dataset and the GCG white-box baseline, providing the 50-goal benchmark subset and the query-count comparison.","marker":"[Zou et al., 2023]"},{"why":"Supplies Llama2-7B, the main robust open-source victim model where GoAT claims its largest relative gain.","marker":"[Touvron et al., 2023]"},{"why":"Supplies Mixtral, the stronger prompt generator that raises GoAT's success rate on Llama2-7B to 62%.","marker":"[Jiang et al., 2024]"},{"why":"Supplies Vicuna-7B and Vicuna-13B, the default prompt generator and one of the victim models in the benchmark.","marker":"[Zheng et al., 2023]"},{"why":"Defines chain-of-thought reasoning, the baseline reasoning style that PAIR uses and that GoAT positions its graph-based approach against.","marker":"[Wei et al., 2022b]"}],"fun_headline_variants":["GoAT jailbreak: graph thinking beats tree attacks","From 4% to 20%: GoAT's graph jailbreaks Llama","Black-box jailbreak: GoAT uses graph synergy to crack LLMs","GoAT's graph pulls off jailbreak with fewer queries","Graph-of-thought jailbreak: GoAT beats tree methods"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The reported success rates depend on the GPT-4-based Evaluator correctly judging when a response actually satisfies the harmful goal; if that judge is too lenient, the headline margins (20% vs. 4% on Llama and 68% vs. 60% on Claude) could shrink or disappear, and the paper's description of the human-check procedure differs between Section 3.2 and Appendix A.2 without resolving the doubt.","fun_headline_variants_meta":{"raw":{"variants":["GoAT jailbreak: graph thinking beats tree attacks","From 4% to 20%: GoAT's graph jailbreaks Llama","Black-box jailbreak: GoAT uses graph synergy to crack LLMs","GoAT's graph pulls off jailbreak with fewer queries","Graph-of-thought jailbreak: GoAT beats tree methods"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000299,"raw_usage":{"total_tokens":1740,"prompt_tokens":969,"completion_tokens":771,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":585,"completion_tokens_details":{"reasoning_tokens":681}},"tokens_in":585,"tokens_out":771,"duration_ms":7500,"temperature":1.0,"reasoning_tokens":681,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T10:03:17.184687+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take the exact 50-goal AdvBench subset used in the paper, rerun GoAT, PAIR, and TAP against Llama2-7B and Claude-3, and have independent human annotators label every response as harmful or not without seeing which method produced it. If the human-verified success rates do not reproduce GoAT's margins over PAIR and TAP on both models, the central claim of superiority fails; a second, cheaper check is to verify whether every prompt GoAT labels successful actually starts with harmful content rather than a refusal followed by safe information.","supporting_citations":[],"review_version":1}