arXiv：cs.AI· Haoyu Zhang, Hanwen Liu, Yang Chen, Shibo Zheng, Xiangchen Guan, Zhuoxi Wang, Zijian Xiao, Xiao Luo, Yi Feng, Haowen Xu, Mohammad Zandsalimy, Shanu Sushmita·· 5 小时前
Depth, Not Breadth：超越表层噪声的 Best-of-N 越狱攻击
Depth, Not Breadth: Best-of-N Jailbreaking Beyond Surface Noise
AI 导读
针对已发表的自检防御 SAGE，在代码补全编码上运行 best-of-N 越狱，在三个开源权重目标模型上分别达到 67%、22% 和 15% 的行为触发率，而该编码单次仅 4.7%、已发表的字符搜索满预算仅 3.0%，相当于各部分之和的 9 至 68 倍。
正文
Authors:Haoyu Zhang, Hanwen Liu, Yang Chen, Shibo Zheng, Xiangchen Guan, Zhuoxi Wang, Zijian Xiao, Xiao Luo, Yi Feng, Haowen Xu, Mohammad Zandsalimy, Shanu Sushmita
Abstract:Best-of-N jailbreaking spends a query budget on surface variation, scrambling and recasing a request until one draw lands. We ask what the same search buys when it wraps a structural encoding instead. Against SAGE, a published self-check defense, best-of-N over a code-completion encoding reaches 67, 22 and 15% of behaviors on three open-weight targets, where that encoding fired once reaches at most 4.7% and the published character search at full budget at most 3.0%: 9 to 68 times the sum of the parts, with bootstrap intervals clearing both ingredients on every target. We report the operative figure beside the headline rather than the headline alone: at the actionable severity threshold those cells read 24, 8 and 1 behaviors (95% interval [13, 28], [3, 13], [0, 3]). A 2x2 on Llama-3.1-8B holding encoding and variation apart shows that SAGE and a classifier gate fail to different factors: SAGE is broken by the depth of the encoding (7 -> 67 behaviors at fixed variation) and the gate by the breadth of the variation (13 -> 57 at fixed encoding). Per-draw reporting also overstates robustness, because an attacker who may try N times experiences the maximum over draws while safety results are reported as means: on one target SAGE stops 99.8% of individual draws yet loses at least as many behaviors to a repeat attacker (12) as a classifier gate that stops 95.6% (10). Removing the target's sampling shrinks SAGE's coverage, relative to its own level, by 59, 76, 82 and 29 percentage points more than an undefended control's, against 25, -5, 8 and 2 for a defense whose verdict comes from a fixed shadow model. The design that loses is the one fusing screening and answering into a single generation, so every attacker draw redraws the safety decision as well. The prescription is architectural, not free: do not fuse screening with generation.
| Comments: | A short version was accepted as a poster at the NeurIPS 2026 JUDGe workshop (non-archival) |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2607.26639 [cs.CR] |
| (or arXiv:2607.26639v3 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2607.26639 arXiv-issued DOI via DataCite |
Submission history
From: Haoyu Zhang [view email]
[v1]
Wed, 29 Jul 2026 09:01:26 UTC (79 KB)
[v2]
Fri, 25 Sep 2026 05:37:15 UTC (94 KB)
[v3]
Mon, 12 Oct 2026 02:28:23 UTC (96 KB)
来源：arXiv：cs.AI · arxiv.org