Pith. sign in

REVIEW 4 cited by

GPT-4 Jailbreaks Itself with Near-Perfect Success Using Self-Explanation

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2405.13077 v2 pith:XBMMC3LR submitted 2024-05-21 cs.CR cs.AIcs.CL

Govind Ramesh , Yao Dou , Wei Xu This is my paper · ORCID
classification cs.CRcs.AIcs.CL
keywords jailbreakingirisgpt-4llmsadversarialblack-boxinterpretablemethods
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

Research on jailbreaking has been valuable for testing and understanding the safety and security issues of large language models (LLMs). In this paper, we introduce Iterative Refinement Induced Self-Jailbreak (IRIS), a novel approach that leverages the reflective capabilities of LLMs for jailbreaking with only black-box access. Unlike previous methods, IRIS simplifies the jailbreaking process by using a single model as both the attacker and target. This method first iteratively refines adversarial prompts through self-explanation, which is crucial for ensuring that even well-aligned LLMs obey adversarial instructions. IRIS then rates and enhances the output given the refined prompt to increase its harmfulness. We find that IRIS achieves jailbreak success rates of 98% on GPT-4, 92% on GPT-4 Turbo, and 94% on Llama-3.1-70B in under 7 queries. It significantly outperforms prior approaches in automatic, black-box, and interpretable jailbreaking, while requiring substantially fewer queries, thereby establishing a new standard for interpretable jailbreaking methods.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation

    cs.CL 2025-08 reject novelty 5.0 of 10

    Sparse autoencoder activation perturbation (SFPF) applied on top of existing jailbreak prompts raises attack success rate on Qwen3-32B, but with no defense evaluation and weak reproducibility.

  2. Activation Reward Models for Few-Shot Model Alignment

    cs.CV 2025-07 conditional novelty 5.0 of 10

    Mean attention-head activations from a few labeled examples, injected into selected heads, turn a frozen vision-language model into a few-shot reward model that beats prompting and scoring baselines and a new reward-h...

  3. On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks against LLMs

    cs.CR 2024-12 reject novelty 4.0 of 10

    Applying CVSS, DREAD, OWASP, and SSVC to 56 adversarial LLM attacks via three LLM judges yields near-constant factor scores, which the authors take as evidence that these metrics cannot differentiate LLM attacks.

  4. Reducing Reasoning Costs: The Path of Optimization for Chain of Thought via Sparse Attention Mechanism

    cs.LG 2024-11 reject novelty 2.0 of 10

    The paper claims that a sparse attention mechanism, embodied in a custom GPT named GiantRabbit, reduces chain-of-thought reasoning time and length versus o1 Preview on nine linear algebra questions, at some accuracy cost.

Pith tools