{"id":"8fca134b-0d7a-49df-8fbb-809835910b4e","arxiv_id":"2505.09820","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Exponentiated gradient descent over relaxed one-hot token encodings finds adversarial suffixes that jailbreak several open-source LLMs with higher success rate and lower runtime than GCG, PGD, and SoftPromptThreats.","lead":"This paper proposes a jailbreaking attack on open-source LLMs by tuning a fake token suffix with exponentiated gradient descent, which keeps each token position on a probability simplex. It reports higher success rates and lower runtime than three existing attack methods across five 7-billion-parameter models and four benchmarks.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Claimed ASR advantage over baselines is not statistically substantiated; single-run results on 50 behaviors overlap with noise and MPT contradicts the headline.","rationale":"The reader's weakest assumption was that Theorem 1 does not cover the implemented Adam-based algorithm, which is indeed a real gap and is acknowledged by the authors in Remark 1. I agree that this is a weakness. However, I consider the statistical fragility of the empirical comparison to be the most load-bearing issue because the paper's headline and contribution are primarily experimental: the method is presented as an attack that outperforms three baselines. If the ASR differences are within noise or reversed on MPT, the paper has no demonstrated value even if the theory were fixed. The theory gap could be remedied by either proving convergence for the Adam variant or rephrasing the contribution as a heuristic; the empirical gap requires rerunning experiments to establish the main result. Therefore, my concern is different from the reader's, but it reinforces the CONDITIONAL verdict: the paper should be accepted only if the empirical superiority is confirmed with statistical evidence. The proposed test (multiple seeds, confidence intervals, McNemar tests) would settle whether the central claim actually lands. If the intervals overlap, the verdict should move to REJECT or UNVERDICTED; if the differences persist with non-overlapping intervals, the empirical claim stands and the remaining theory issue is secondary.","tokens_in":13586,"tokens_out":11528,"duration_ms":110595,"concrete_test":"Repeat the full comparison (5 models, 4 datasets, 4 methods) with at least 5 independent random seeds (the suffix initialization is random for EGD/PGD; GCG's initial '!' suffix is fixed but the attack has randomness in sampling). Compute the mean and 95% bootstrap confidence interval of ASR per method per dataset/model, and run a paired McNemar test between EGD and each baseline on the 50 (or 200 pooled) paired outcomes. Also report the distribution of per-behavior runtime (median and IQR) across seeds. If EGD's ASR confidence intervals overlap GCG's on most models, or McNemar p>0.05, the claim of higher success rate is not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is the empirical assertion in the Abstract that EGD 'achieves a higher success rate with great efficiency' than GCG, PGD, and SoftPromptThreats. All ASR values in Table II come from one run on the first 50 behaviors of each dataset; there are no error bars, no multiple seeds, and no significance tests. With N=50, the 95% confidence interval for a proportion is approximately ±13 percentage points, so the per-dataset differences (e.g., Llama-2 AdvBench: EGD 10 vs GCG 5) are not distinguishable from noise. Even pooling 200 behaviors per model, the overall differences are around 5–10 percentage points, roughly 1–2 standard errors. The MPT row actively contradicts the headline: EGD overall ASR(>10)=39.0% vs GCG=42.0%, and EGD is worse on MaliciousInstruct (21 vs 29). The runtime advantage in Figure 2 is reported as a single average without variance, so 'great efficiency' is also unquantified. The current evidence is insufficient to support the claimed superiority.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes an adversarial attack on large language models using exponentiated gradient descent (EGD) applied to a continuously relaxed one-hot encoding of the input tokens. The method maintains the relaxed encoding on the probability simplex by combining a multiplicative EGD step with a Bregman (KL) projection, as formalized in Equation (6). The authors claim to prove convergence of this iteration for smooth losses (Theorem 1), and they implement an efficient variant that additionally uses the Adam optimizer and two regularization terms (entropic regularization and a KL sparsity term), as described in Appendix A. The attack is evaluated on five open-source LLMs (Llama-2, Vicuna, Mistral, Falcon, MPT) and four jailbreak datasets, using the first 50 harmful behaviors per dataset. The reported results in Table II compare the attack success rate (ASR) with GCG, PGD, and SoftPromptThreats, and Figure 2 compares runtime. The paper concludes that the proposed EGD attack 'achieves a higher success rate with great efficiency' compared with the three baselines.","tokens_in":13840,"tokens_out":9480,"duration_ms":92879,"significance":"If the empirical and theoretical claims were fully supported, the paper would offer a useful white-box jailbreaking method with a principled treatment of the simplex constraint, and it would contribute a practical comparison of mirror-descent-style optimization to existing discrete and continuous attacks. The idea of optimizing a relaxed one-hot encoding with EGD is a sensible extension of prior work on PGD-based attacks, and the availability of source code is a plus. However, the significance is currently limited by two central weaknesses. First, the convergence theorem (Theorem 1) does not apply to the algorithm actually evaluated in the experiments: the authors explicitly concede in Remark 1 that the theorem excludes the Adam-based variant used throughout the empirical section. Second, the empirical superiority claim is not statistically substantiated: the ASR results come from a single run on only 50 behaviors per dataset, with no error bars, repeated seeds, or significance tests, and one of the five model rows (MPT) contradicts the headline claim. The theoretical result is also essentially standard mirror-descent convergence, so the novelty is incremental.","major_comments":[{"comment":"The convergence guarantee in Theorem 1 applies to the plain EGD iteration (6) under the assumption that F is differentiable with Lipschitz gradient. The algorithm actually used in the experiments is the EGD-with-Adam variant (Appendix A, Eq. 13) with a composite loss that includes entropic regularization and a KL sparsity term (Eq. 15) and a time-varying tau schedule. Remark 1 explicitly states that the theorem does not apply to the Adam-based variant. Therefore the paper's claim that it 'prove[s] the convergence of the technique' (Abstract) is not established for the implemented method. The authors should either provide a convergence analysis for the regularized, Adam-updated variant or restrict the empirical claims to the plain EGD update that the theorem actually covers.","section":"Section III-D and Appendix A"},{"comment":"The reported ASR values are based on a single run over the first 50 behaviors of each dataset, with no repeated runs, no error bars, and no significance tests. For N=50, the 95% confidence interval for a proportion is approximately +/-13 percentage points, so most pairwise differences in Table II (e.g., Llama-2 AdvBench: EGD 10 vs GCG 5) are indistinguishable from noise. The MPT row actively contradicts the headline: EGD's overall ASR(>10) is 39.0% versus GCG's 42.0%, and on MaliciousInstruct EGD scores 21 while GCG scores 29. The runtime comparison in Figure 2 is also a single average without variance. Consequently, the abstract's claim that the method 'achieves a higher success rate with great efficiency' is not supported by the evidence. The authors should provide multi-seed runs, standard errors, and appropriate statistical tests (e.g., paired bootstrap or McNemar's test).","section":"Section IV-B2 and Table II"},{"comment":"The hyperparameters appear to have been selected on the evaluation data. The text states that 'using a fixed learning rate eta=0.1 works best for our method in most cases' and that the number of epochs was 'determine[d] empirically' from the optimization curves. There is no description of a validation split or a priori fixed hyperparameters. If eta, the tau schedule, and the epoch count were tuned after inspecting the same 50-behavior test sets used in Table II, the reported ASRs are optimistically biased and the comparison with baselines is not fair. The authors should specify a proper tuning protocol (e.g., a held-out validation split) or report results for fixed hyperparameters that were not selected using the test data.","section":"Section IV-A4"},{"comment":"The discussion claims that the method 'inherently satisfies the constraints on the input without requiring any projection technique to enforce them' and that it eliminates 'the necessity of an extrinsic technique, such as projection.' This is contradicted by the main iteration (6), which explicitly applies the Bregman projection P_KL, and by Section III-C, which is devoted to deriving that projection. The plain EGD update (2) does not ensure row-wise simplex constraints for a matrix variable, which is why the projection is introduced. The presentation is internally inconsistent and overstates the contribution; it should be corrected to acknowledge that the method uses a KL-based projection as part of the update.","section":"Section V and Eq. (6)"},{"comment":"The proof of Theorem 1 is too terse to be verifiable. The equivalence between iteration (6) and the forward-backward form (7) is asserted without derivation, and no conditions on the learning rates are given beyond 'small enough.' A rigorous argument should specify the required assumptions (e.g., strong convexity of the KL mirror map relative to the feasible set, the Lipschitz constant of the gradient, and the explicit bound on eta_t). Without these details, the theorem as stated is not established to a journal standard.","section":"Theorem 1 proof (Section III-D)"}],"minor_comments":[{"comment":"There is a dimension mismatch in the definition of the set C: it is written as \\tilde X \\in [0,1]^{|T|\\times L} with the condition \\tilde X 1_{|T|} = 1_L, but this matrix-vector product is not well-typed for the stated dimensions. Please reconcile the dimensions.","section":"Equation (8)"},{"comment":"The KL divergence formula in Eq. (4) includes an extra '-1' inside the sum; the standard definition is KL(Y||X) = \\sum Y_ij \\log(Y_ij/X_ij). Please clarify whether the '-1' is intentional or a typographical error.","section":"Equation (4)"},{"comment":"The 'Overall(%)' rows should also report the absolute counts (e.g., 20/200) alongside the percentages, so that readers can assess the uncertainty given that each dataset contributes only 50 items.","section":"Table II"},{"comment":"The runtime comparison reports a single average per method without variance or the number of trials; please add error bars or per-run values.","section":"Figure 2"},{"comment":"The sentence 'For consistency, we follow the method prescribed by the corresponding authors to initialize the adversarial suffix in each instance. For GCG and SoftPromptThreats, we use a sequence of 20 space-separated exclamation marks (\"!\").' is ambiguous about whether the '!' initialization is the one prescribed by the authors; please rephrase for clarity.","section":"Section IV-A3"},{"comment":"The notation for the Adam denominator is inconsistent: the text uses both '\\delta+' and '\\epsilon+' in the same equation. Please unify the symbol.","section":"Appendix A, Eq. (13)"}],"recommendation":"major_revision","confidential_remarks":"The manuscript fits the scope of the journal, and the code availability is a positive feature. However, the empirical evaluation is currently below the standard expected for a journal publication: single-run results on 50 items per dataset, no error bars, and a contradictory result for MPT make the abstract's comparative claims unsupported. The mismatch between the proven convergence theorem and the actually implemented algorithm is a further concern that the authors will need to resolve, either by aligning the experiments with the theory or by extending the theory. I would encourage the authors to perform a more rigorous empirical study with multiple seeds and statistical tests, and to temper the claims in the abstract accordingly."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is an incremental but legitimate idea—replacing PGD's projection step with exponentiated gradient descent's intrinsic row normalization for relaxed one-hot suffix optimization. The method is clean, the write-up is honest about what the theory does and doesn't cover, and they ship code. The problem is that the empirical claim in the abstract ('higher success rate with great efficiency') is not supported by the evidence as presented.\n\nWhat's new: using EGD with Bregman projection to stay on the probability simplex during continuous token optimization is a small but real departure from PGD. The convergence theorem is stated for smooth losses, and Remark 1 explicitly says it does not cover ReLU-based models or the Adam variant actually evaluated. That is the right kind of honesty. The paper also evaluates on five models and four datasets, which is more than many attack papers do.\n\nWhere it falls soft: the experimental protocol is too weak for the claim. All ASR numbers come from one run on the first 50 behaviors of each dataset, with no error bars, no seeds, no significance tests. With N=50, the difference between EGD's 10% and GCG's 5% on Llama-2 is within sampling noise. The MPT row actively contradicts the abstract: EGD's overall ASR(>10) is 39.0% versus GCG's 42.0%, and EGD is worse on MaliciousInstruct (21 vs 29). The runtime advantage in Figure 2 is a single average, so 'great efficiency' is unquantified. The hyperparameters (eta=0.1, tau schedule) were tuned on the evaluation data, which is mild adaptation, though the reported success rates are not reused as constants. The convergence theorem, as the authors admit, does not apply to the algorithm used in the experiments; this is fine if the paper is framed as empirical, but the abstract's 'prove the convergence of the technique' overstates the coverage.\n\nWho this is for: people working on white-box jailbreak methods for open-source LLMs. The core idea—EGD as a drop-in replacement for projection in relaxed one-hot optimization—is worth knowing about, but the current results are not reliable enough to cite as evidence of superiority.\n\nRecommendation: this deserves a serious referee, but the paper needs major revision before acceptance. The authors should either run proper repeated trials with error bars and significance tests, reframe the claims to match the statistical reality (including the MPT counterexample), or both. The honest limitation discussion is a point in their favor, but it does not fix the gap between what they claim and what the experiments show.","headline":"A plausible incremental optimization tweak for white-box jailbreaks, honestly flagged as unproven for the tested variant, but the headline ASR advantage is not statistically supported by single-run results on 50 behaviors per dataset.","tokens_in":14343,"tokens_out":1590,"would_cite":false,"duration_ms":18032,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that exponentiated gradient descent with Bregman projection produces a white-box jailbreak attack on open-source LLMs that is faster and more successful than GCG, PGD, and SoftPromptThreats.","keywords":["adversarial attack","jailbreak","large language models","exponentiated gradient descent","Bregman projection","probability simplex","attack success rate","LLM safety"],"falsifier":"Run the exact EGD-with-Adam implementation from Appendix A on a model with nonsmooth ReLU activations and measure the gradient-norm trajectory; if the iterates do not approach a critical point, or if attack success collapses when Adam and the regularization terms are removed on a smooth model such as Llama-2, then the implemented algorithm's behavior is not explained by Theorem 1.","tokens_in":13431,"feed_emoji":"🔓","tokens_out":6046,"duration_ms":58870,"temperature":0.7,"pith_summary":"This paper claims that a white-box jailbreak of open-source large language models can be cast as a constrained optimization over relaxed one-hot token encodings, and that exponentiated gradient descent with KL-divergence (Bregman) projection solves it faster and more effectively than the leading alternatives. The authors prove that their update converges to a critical point of the adversarial loss when the loss is smooth, and they implement a practical version with Adam and entropic regularization. On five open models and four public datasets they report higher attack success rates and shorter runtimes than GCG, projected gradient descent, and SoftPromptThreats. If the claim holds, it gives safety researchers a cheap tool for finding aligned-model failures.","feed_headline":"New attack jailbreaks five open LLMs faster","feed_subtitle":"It optimizes token probabilities inside the model and beats three existing methods on success rate and runtime.","key_machinery":"The load-bearing object is Equation (6), the exponentiated-gradient-descent update with Bregman projection: $\\tilde{X}_t = P_{KL}(\\tilde{X}_{t-1} \\odot \\exp(-\\eta_t \\nabla F(\\tilde{X}_{t-1})))$. The Bregman projection here is the KL-divergence projection onto the set of row-stochastic matrices, whose closed form is row normalization. This single step makes the simplex constraint intrinsic to the optimization rather than an external repair step, and the theorem connects the iteration to the forward-backward algorithm to get convergence. In the practical attack, Adam momentum, entropic regularization $-\\tau H(X)$, and a KL term between the continuous and discretized encodings are added to sparsify the relaxed distribution.","core_discovery":"The central discovery is that optimizing a relaxed one-hot encoding of the adversarial suffix does not need an explicit projection back to the probability simplex, as long as the update itself is exponentiated gradient descent followed by normalization: $\\tilde{X}_t = P_{KL}(\\tilde{X}_{t-1} \\odot \\exp(-\\eta_t \\nabla F(\\tilde{X}_{t-1})))$. Each row remains a distribution because the Bregman projection simply rescales rows to sum to one. The paper proves this iteration reaches a critical point for differentiable losses with Lipschitz gradient by identifying it as a forward-backward algorithm. In the implemented system, an Adam-style momentum variant, entropic regularization, and a KL sparsity term are added; with those components, the paper reports higher attack success rates than the three baselines on most of the tested models and the lowest runtime per optimization.","pith_inferences":["Because Theorem 1 explicitly excludes the Adam variant used in the experiments, the empirical results carry the argument for most of the tested models; a convergence proof for the nonsmooth or Adam setting would close that gap.","The entropic and KL regularization terms are largely decoupled from the convergence theorem, so an ablation on a smooth model could reveal whether the theoretical update alone drives jailbreak success or whether the regularization is essential.","If the runtime advantage persists beyond the 50-prompt samples, batch or universal suffix searches, where one suffix is optimized across many harmful behaviors, become considerably cheaper; the paper lists universality and transferability as future work.","The same intrinsic simplex optimization could transfer to multimodal models that accept continuous inputs, since the relaxed one-hot mechanism is not tied to text-specific preprocessing."],"forward_implications":["White-box red-teaming becomes cheaper: for the same number of epochs, the reported method completes a single harmful-behavior optimization in less runtime than all three baselines.","Attack success rate improves on most tested models; for example, on Mistral-7B the overall success rate at the stricter evaluator threshold is 54.5% versus 45.0% for GCG, 38.5% for PGD, and 24.5% for SoftPromptThreats.","The relaxed-one-hot formulation with KL projection keeps each token position on the probability simplex by construction, removing the need for an external nearest-neighbor projection step that PGD requires.","For smooth models such as Llama-2, the attack iteration carries a convergence guarantee to a critical point, giving the empirical results a theoretical anchor in that setting."],"supporting_citations":[{"why":"Defines the GCG baseline and supplies the AdvBench goal/target pairs used for the evaluation.","marker":"[21]"},{"why":"Introduces the continuous relaxed one-hot attack with projected gradient descent; it is the main competitor and the source of the relaxation formulation.","marker":"[23]"},{"why":"SoftPromptThreats, the embedding-space gradient-descent baseline that EGD is compared against.","marker":"[24]"},{"why":"Original exponentiated gradient descent algorithm that the update rule is based on.","marker":"[36]"},{"why":"EGD with momentum for online portfolio selection; the source of the Adam-enhanced variant used in the implementation.","marker":"[37]"},{"why":"Adam optimizer used to stabilize the exponentiated gradient updates.","marker":"[38]"},{"why":"Gives the closed-form Bregman/KL projection used in the main iteration.","marker":"[40]"},{"why":"Forward-backward algorithm convergence result invoked in the proof of Theorem 1.","marker":"[41]"}],"fun_headline_variants":["Exponentiated gradient jailbreaks five open LLMs faster","Exponentiated gradient attack: higher success, lower runtime","Token-probability optimization jailbreaks LLMs quicker","New LLM attack uses exponentiated gradient for faster jailbreaks","Exponentiated gradient: efficient jailbreaking of five LLMs"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the adversarial loss is differentiable with a Lipschitz-continuous gradient, which the paper itself notes fails for ReLU-based models and does not cover the Adam variant actually used in the experiments; if that premise gives way, the convergence theorem no longer applies and the method's success stands only on its empirical results.","fun_headline_variants_meta":{"raw":{"variants":["Exponentiated gradient jailbreaks five open LLMs faster","Exponentiated gradient attack: higher success, lower runtime","Token-probability optimization jailbreaks LLMs quicker","New LLM attack uses exponentiated gradient for faster jailbreaks","Exponentiated gradient: efficient jailbreaking of five LLMs"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001023,"raw_usage":{"total_tokens":4318,"prompt_tokens":954,"completion_tokens":3364,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":570,"completion_tokens_details":{"reasoning_tokens":3296}},"tokens_in":570,"tokens_out":3364,"duration_ms":24074,"temperature":1.0,"reasoning_tokens":3296,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T21:23:04.660346+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the exact EGD-with-Adam implementation from Appendix A on a model with nonsmooth ReLU activations and measure the gradient-norm trajectory; if the iterates do not approach a critical point, or if attack success collapses when Adam and the regularization terms are removed on a smooth model such as Llama-2, then the implemented algorithm's behavior is not explained by Theorem 1.","supporting_citations":[{"cited_title":"Attacking large language models with projected gradient descent,","cited_arxiv_id":null,"evidence_quote":"Introduces the continuous relaxed one-hot attack with projected gradient descent; it is the main competitor and the source of the relaxation formulation."},{"cited_title":"Exponentiated gradient versus gradient descent for linear predictors,","cited_arxiv_id":null,"evidence_quote":"Original exponentiated gradient descent algorithm that the update rule is based on."},{"cited_title":"Exponential gradient with momentum for online portfolio selection,","cited_arxiv_id":null,"evidence_quote":"EGD with momentum for online portfolio selection; the source of the Adam-enhanced variant used in the implementation."},{"cited_title":"Iterative bregman projections for regularized transportation problems,","cited_arxiv_id":null,"evidence_quote":"Gives the closed-form Bregman/KL projection used in the main iteration."},{"cited_title":"An inertial forward-backward algorithm for the minimization of the sum of two nonconvex functions,","cited_arxiv_id":null,"evidence_quote":"Forward-backward algorithm convergence result invoked in the proof of Theorem 1."}],"review_version":1}