Breadth Beats Depth: Improving GCG-Based Jailbreak Optimization with Breadth-Oriented Suffix Search

# Breadth Beats Depth: Improving GCG-Based Jailbreak Optimization with Breadth-Oriented Suffix Search
Source: [https://arxiv.org/html/2609.02172](https://arxiv.org/html/2609.02172)
Jingsong Wei11footnotemark:1Yuzhi Liang††thanks:Corresponding author\.Yufan ZhengXia LiQiliang LinAffiliation:School of Information Science and TechnologyAffiliation:Guangdong University of Foreign StudiesAffiliation:\{yzliang, xiali\}@gdufs\.edu\.cnAffiliation:\{slxiao, jswei, yfzheng, qllin\}@mail\.gdufs\.edu\.cn

###### Abstract

Optimization\-based jailbreak attacks such as Greedy Coordinate Gradient \(GCG\) achieve strong effectiveness and transferability by optimizing adversarial suffixes on white\-box source models\. However, existing GCG\-based methods rely on averaged adversarial loss and deep greedy search, which can over\-emphasize easy\-to\-jailbreak behaviors and overlook promising regions of the suffix space\. We propose BOSS, a plug\-and\-play framework that improves GCG\-based jailbreak optimization through breadth\-oriented suffix search\. BOSS uses Tail\-Focused Adversarial Loss \(TFAL\), standard source loss, and behavior coverage to select terminal suffixes, then explores multiple short trajectories and selectively continues promising suffixes\. Experiments on public benchmarks show that BOSS improves attack success rates across multiple GCG\-based methods while reducing optimization time\.

## 1Introduction

Large language models \(LLMs\) are increasingly protected by safety alignment and content moderation mechanisms, yet they remain vulnerable to jailbreak attacks\. Jailbreaks use specially crafted inputs to bypass safeguards and induce models to follow harmful instructions\. Among existing attacks, optimization\-based jailbreak methods have received substantial attention due to their strong effectiveness and transferability\.

A representative method is Greedy Coordinate Gradient[Zou et al\. \(2023\)](https://arxiv.org/html/2609.02172#bib.bib2), which appends an adversarial suffix to a harmful prompt and iteratively updates the suffix using source\-model gradients\. Subsequent work improves GCG through stronger objectives, templates, initialization, candidate construction, and insertion locations[Jia et al\. \(2025\)](https://arxiv.org/html/2609.02172#bib.bib4);[Liao and Sun \(2024\)](https://arxiv.org/html/2609.02172#bib.bib5);[Zhou et al\. \(2025\)](https://arxiv.org/html/2609.02172#bib.bib6);[Jeong et al\. \(2026\)](https://arxiv.org/html/2609.02172#bib.bib8)\.

Despite these advances, existing GCG\-based jailbreak methods still face two key limitations\.First, they typically optimize the average adversarial loss over multiple harmful behaviors, where the loss is defined by the likelihood of predefined target tokens\. However, this averaged objective can be unreliable for jailbreak optimization\. Unlike classification tasks, where successfully optimized examples often contribute little additional loss, jailbreak optimization is a generative target\-matching problem: even when a behavior can already be successfully jailbroken, its target\-sequence loss may remain nonzero\. As a result, easy behaviors may continue to consume optimization effort, while harder behaviors that remain poorly optimized receive insufficient attention\.Second, existing GCG\-based methods often allocate most computation to searching deeper along greedy trajectories\. However, the suffix with the lowest current source loss is not necessarily on a trajectory that leads to the best final suffix\. As shown in Figure[1](https://arxiv.org/html/2609.02172#S1.F1), suffixes selected by several GCG\-based algorithms can still deviate from suffixes with substantially lower attainable adversarial losses\. This suggests that deeper greedy search can miss promising regions of the suffix space, and that broader exploration may be more effective under a fixed optimization budget\.

Figure 1:The final suffix can miss more effective suffixes during search\.To address these limitations, we propose Breadth\-Oriented Suffix Search \(BOSS111Our code is anonymously available at[https://anonymous\.4open\.science/r/code\-3121](https://anonymous.4open.science/r/code-3121)\.\), a simple yet effective search framework for GCG\-based jailbreak optimization\. We first introduce Tail\-Focused Adversarial Loss, a source\-side diagnostic that emphasizes high\-loss behaviors that remain difficult to optimize\. Rather than treating all behaviors uniformly, TFAL directs selection pressure toward the hard tail of the per\-behavior loss distribution\. To avoid sacrificing broad attack coverage, BOSS uses behavior coverage as a gate and ranks eligible terminal suffixes with a weighted combination of the standard source loss and TFAL\. Beyond the loss diagnostic, BOSS reallocates the optimization budget from depth to breadth\. Instead of committing most computation to a single long greedy trajectory, BOSS runs multiple short optimization trajectories, retains their terminal suffixes, selects promising parents using source\-side diagnostics, continues selected parents with additional budget, and finally chooses the best suffix from the combined terminal set\. This design explores a broader suffix pool while remaining plug\-and\-play with existing GCG\-based jailbreak methods\.

Our main contributions are summarized as follows:

- •We identify a limitation of the standard averaged adversarial loss used in optimization\-based jailbreak attacks, and propose TFAL, a hard\-behavior\-focused objective that better reflects jailbreak optimization progress and improves final attack success rate\.
- •We propose Breadth\-Oriented Suffix Search, a plug\-and\-play framework for GCG\-based jailbreak optimization\. BOSS reallocates computation from deep greedy search to broad suffix exploration by running multiple short trajectories and selectively continuing promising candidates\.
- •Experiments on public benchmarks show that integrating BOSS into multiple GCG\-based jailbreak algorithms achieves higher attack success rates while requiring less running time\.

## 2Related Work

### 2\.1Optimization\-Based Discrete Suffix Jailbreaks

Gradient\-guided discrete token search has been used to construct universal adversarial triggers for NLP models[Wallace et al\. \(2019\)](https://arxiv.org/html/2609.02172#bib.bib15)\. GCG applies this idea to aligned LLMs by appending an adversarial suffix to harmful prompts and updating suffix tokens with source\-model gradients toward an affirmative target response[Zou et al\. \(2023\)](https://arxiv.org/html/2609.02172#bib.bib2)\. Recent suffix attacks improve different parts of this process: I\-GCG changes target templates, coordinate updates, and initialization[Jia et al\. \(2025\)](https://arxiv.org/html/2609.02172#bib.bib4); AmpleGCG trains a generator from successful GCG suffixes[Liao and Sun \(2024\)](https://arxiv.org/html/2609.02172#bib.bib5); DSN adds refusal suppression to source\-model optimization[Zhou et al\. \(2025\)](https://arxiv.org/html/2609.02172#bib.bib6); GJO removes response\-pattern and token\-tail constraints[Yang et al\. \(2025\)](https://arxiv.org/html/2609.02172#bib.bib7); and SlotGCG studies adversarial token insertion positions[Jeong et al\. \(2026\)](https://arxiv.org/html/2609.02172#bib.bib8)\. These works mainly improve the objective, initialization, generation, or placement of discrete suffixes\. Our work is orthogonal: it keeps the local GCG\-style optimizer and changes how terminal suffixes from multiple short source\-model trajectories are retained, selected, and continued\.

### 2\.2Search Trajectories and Budget Allocation

For discrete suffix optimization, the final suffix depends not only on the source loss but also on how the fixed search budget is spent\. Standard GCG\-style optimizers evaluate many token substitutions at each step, but the next step proceeds from selected incumbent suffixes, so other evaluated candidates usually receive no continuation budget\. This resembles a broader search problem: keeping only one active hypothesis is efficient, but it can discard candidates before their later value is tested\.

Related work has studied this issue in other settings\. Beam\-search optimization keeps multiple hypotheses for sequence\-to\-sequence learning[Wiseman and Rush \(2016\)](https://arxiv.org/html/2609.02172#bib.bib20)\. Random search and Bayesian optimization allocate evaluations across independent or surrogate\-guided trials[Bergstra and Bengio \(2012\)](https://arxiv.org/html/2609.02172#bib.bib19);[Snoek et al\. \(2012\)](https://arxiv.org/html/2609.02172#bib.bib21)\. Best\-arm identification, successive halving, Hyperband, ASHA, and population\-based training allocate more budget to candidates or configurations that appear promising under partial evaluation[Audibert et al\. \(2010\)](https://arxiv.org/html/2609.02172#bib.bib22);[Karnin et al\. \(2013\)](https://arxiv.org/html/2609.02172#bib.bib23);[Jamieson and Talwalkar \(2016\)](https://arxiv.org/html/2609.02172#bib.bib1);[Li et al\. \(2018\)](https://arxiv.org/html/2609.02172#bib.bib18);[Li et al\. \(2020\)](https://arxiv.org/html/2609.02172#bib.bib24);[Li et al\. \(2019\)](https://arxiv.org/html/2609.02172#bib.bib25)\. These methods motivate budget allocation across candidates, but they do not directly address terminal adversarial suffixes produced by gradient\-guided discrete optimization\.

Multi\-start and random\-search jailbreak attacks also introduce more initial states[Andriushchenko et al\. \(2025\)](https://arxiv.org/html/2609.02172#bib.bib16)\. In contrast, BOSS applies budget allocation inside source\-model suffix optimization: it runs short trajectories, retains terminal suffixes, selects parents with source\-side diagnostics, continues them, and selects the final suffix before target\-model evaluation\.

## 3Problem Setup

We optimize a single adversarial suffix on a white\-box source model\. Let𝒳t​r\\mathcal\{X\}\_\{tr\}denote the training harmful behaviors andMsM\_\{s\}denote the source model\. For a behaviorx∈𝒳t​rx\\in\\mathcal\{X\}\_\{tr\}, letz=\(z1,…,zL\)z=\(z\_\{1\},\\ldots,z\_\{L\}\)denote a suffix of lengthLLwith tokens from vocabulary𝒱\\mathcal\{V\}, and letΦ⁡\(x,z\)\\Phi\(x,z\)denote the prompt constructor that takes behaviorxxand suffixzzas input\.

For each behaviorxx, lety⁡\(x\)y\(x\)denote the affirmative response prefix token sequence used to score the source model, let\|y⁡\(x\)\|\|y\(x\)\|be its length, and lety<r​\(x\)y\_\{<r\}\(x\)denote its tokens before positionrr\. We score suffixzzon behaviorxxwith the per\-behavior source loss, the source\-model negative log\-likelihood of this response prefix underMsM\_\{s\}:

ℓs\(x,z\)=−∑r=1\|y⁡\(x\)\|logpMs\(yr\(x\)∣Φ\(x,z\),y<r\(x\)\)\.\\ell\_\{s\}\(x,z\)=\-\\sum\_\{r=1\}^\{\|y\(x\)\|\}\\log p\_\{M\_\{s\}\}\\\!\\left\(y\_\{r\}\(x\)\\mid\\Phi\(x,z\),y\_\{<r\}\(x\)\\right\)\.\(1\)The source loss averages this objective over the training harmful behaviors:

ℒsrc​\(z,𝒳t​r\)=1\|𝒳t​r\|​∑x∈𝒳t​rℓs​\(x,z\)\.\\mathcal\{L\}\_\{\\mathrm\{src\}\}\(z;\\mathcal\{X\}\_\{tr\}\)=\\frac\{1\}\{\|\\mathcal\{X\}\_\{tr\}\|\}\\sum\_\{x\\in\\mathcal\{X\}\_\{tr\}\}\\ell\_\{s\}\(x,z\)\.\(2\)

## 4Method

BOSS consists of three stages\. First, it runs the base GCG\-style optimizer multiple times for a small number of steps to construct an initial terminal suffix set\. Second, it selects promising terminal suffixes using source\-side diagnostics, including behavior coverage, the standard source loss, and TFAL\. Third, it continues the selected parent suffixes and chooses the final suffix from the combined terminal set for target\-model evaluation\. The overview of the process is in Figure[2](https://arxiv.org/html/2609.02172#S4.F2)\.

![Refer to caption](https://arxiv.org/html/2609.02172v1/figs/boss_pipeline.jpg)Figure 2:BOSS retains terminal suffixes and continues selected parents before final selection\. It forms an initial suffix poolA1A\_\{1\}fromNNshort optimization runs, selectsKKparent suffixes with source\-side diagnostics, continues the selected parents to obtainA2A\_\{2\}, and selectsz⋆z^\{\\star\}fromA1∪A2A\_\{1\}\\cup A\_\{2\}before target evaluation\.### 4\.1Base Optimization and Initial Suffix Pool

Existing suffix optimizers maintain one incumbent suffix and update it by minimizing the source loss\. We use this local update as the base optimizer inside BOSS\. At steptt, let the incumbent suffix bezt=\(z1t,…,zLt\)z^\{t\}=\(z\_\{1\}^\{t\},\\ldots,z\_\{L\}^\{t\}\)\. For each coordinatejj, we score each candidate replacement tokenv∈𝒱v\\in\\mathcal\{V\}by the predicted loss decrease under a first\-order approximation:

Δj​\(v,zt\)=−∇ezjtℒsrc​\(zt,𝒳t​r\)⊤​\(ev−ezjt\),\\Delta\_\{j\}\(v;z^\{t\}\)=\-\\nabla\_\{e\_\{z\_\{j\}^\{t\}\}\}\\mathcal\{L\}\_\{\\mathrm\{src\}\}\(z^\{t\};\\mathcal\{X\}\_\{tr\}\)^\{\\top\}\(e\_\{v\}\-e\_\{z\_\{j\}^\{t\}\}\),\(3\)whereeve\_\{v\}denotes the one\-hot token indicator for tokenvv\. The topκ\\kappareplacement set for coordinatejjis

𝒱jt=TopKκ,v∈𝒱⁡Δj​\(v,zt\)\.\\mathcal\{V\}\_\{j\}^\{t\}=\\operatorname\{TopK\}\_\{\\kappa,\\,v\\in\\mathcal\{V\}\}\\Delta\_\{j\}\(v;z^\{t\}\)\.
The optimizer then forms a candidate set by sampling coordinates and replacement tokens from these sets\. Letqtq\_\{t\}be the position sampling distribution over suffix coordinates,BBbe the candidate batch size, andReplace⁡\(z,j,v\)\\operatorname\{Replace\}\(z,j,v\)be the suffix obtained by replacing coordinatejjofzzwith tokenvv:

𝒞t=\{Replace\(zt,jb,vb\)\|\\displaystyle\\mathcal\{C\}\_\{t\}=\\bigl\\\{\\operatorname\{Replace\}\(z^\{t\},j\_\{b\},v\_\{b\}\)\\;\\big\|jb∼qt,\\displaystyle j\_\{b\}\\sim q\_\{t\},\(4\)vb∼Unif⁡\(𝒱jbt\),\\displaystyle v\_\{b\}\\sim\\mathrm\{Unif\}\(\\mathcal\{V\}\_\{j\_\{b\}\}^\{t\}\),b=1,…,B\}\.\\displaystyle b=1,\\ldots,B\\bigr\\\}\.Gradient scores only propose replacements; each candidate suffix is evaluated with the full source loss\. The incumbent suffix is updated by

zt\+1=arg⁡minz~∈𝒞t​ℒsrc​\(z~,𝒳t​r\)\.z^\{t\+1\}=\\arg\\min\_\{\\tilde\{z\}\\in\\mathcal\{C\}\_\{t\}\}\\mathcal\{L\}\_\{\\mathrm\{src\}\}\(\\tilde\{z\};\\mathcal\{X\}\_\{tr\}\)\.\(5\)
We call the sequence of incumbents selected in one run a trajectory, and the suffix obtained after a fixed number of update steps a terminal suffix\. The base optimizer continues one incumbent suffix; other candidate suffixes affect local updates but do not enter the terminal set\.

BOSS forms the initial suffix pool by running the base optimizer multiple times\. We denote oneTT\-step run by𝒜⁡\(Ms,𝒳t​r,z0,T,ξ\)\\mathcal\{A\}\(M\_\{s\},\\mathcal\{X\}\_\{tr\},z^\{0\},T;\\xi\), wherez0z^\{0\}is the initial suffix andξ\\xidenotes the randomness used in candidate sampling\. The initial suffix pool is

A1=\{ziT1=𝒜\(Ms,𝒳t​r,z0,T1;ξi\)\}i=1N,A\_\{1\}=\\left\\\{z\_\{i\}^\{T\_\{1\}\}=\\mathcal\{A\}\(M\_\{s\},\\mathcal\{X\}\_\{tr\},z^\{0\},T\_\{1\};\\xi\_\{i\}\)\\right\\\}\_\{i=1\}^\{N\},\(6\)where eachξi\\xi\_\{i\}controls an independent optimization run\.

### 4\.2Parent Selection with Source\-Side Diagnostics

The incumbent update in Eq\.[5](https://arxiv.org/html/2609.02172#S4.E5)uses average source loss, while parent selection chooses which terminal suffixes receive continuation\. BOSS uses behavior coverage as a gate and ranks eligible terminal suffixes with source\-side diagnostics\. With source\-loss thresholdτc\\tau\_\{c\}, we define behavior coverage as the fraction of training harmful behaviors whose per\-behavior loss satisfies the threshold:

c\(z\)=1\|𝒳t​r\|∑x∈𝒳t​r𝟏\{ℓs\(x,z\)≤τc\}\.c\(z\)=\\frac\{1\}\{\|\\mathcal\{X\}\_\{tr\}\|\}\\sum\_\{x\\in\\mathcal\{X\}\_\{tr\}\}\\mathbf\{1\}\\\{\\ell\_\{s\}\(x,z\)\\leq\\tau\_\{c\}\\\}\.\(7\)LetLsrc​\(z\)=ℒsrc​\(z,𝒳t​r\)L\_\{\\mathrm\{src\}\}\(z\)=\\mathcal\{L\}\_\{\\mathrm\{src\}\}\(z;\\mathcal\{X\}\_\{tr\}\)\. Letℋqh​\(z\)\\mathcal\{H\}\_\{q\_\{h\}\}\(z\)be the set of the⌈qh​\|𝒳t​r\|⌉\\lceil q\_\{h\}\|\\mathcal\{X\}\_\{tr\}\|\\rceilharmful behaviors with the largest per\-behavior losses under suffixzz, whereqh∈\(0,1\]q\_\{h\}\\in\(0,1\]\. We define the Tail\-Focused Adversarial Loss \(TFAL\) as

Lhard​\(z\)=1\|ℋqh​\(z\)\|​∑x∈ℋqh​\(z\)ℓs​\(x,z\)\.L\_\{\\mathrm\{hard\}\}\(z\)=\\frac\{1\}\{\|\\mathcal\{H\}\_\{q\_\{h\}\}\(z\)\|\}\\sum\_\{x\\in\\mathcal\{H\}\_\{q\_\{h\}\}\(z\)\}\\ell\_\{s\}\(x,z\)\.\(8\)Both TFAL and the selection score below are source\-side diagnostics derived from the per\-behavior source loss\.

Before ranking suffixes in a terminal setAA, we min\-max normalizeLsrcL\_\{\\mathrm\{src\}\}andLhardL\_\{\\mathrm\{hard\}\}withinAA, and denote the normalized signals asL¯src,A\\bar\{L\}\_\{\\mathrm\{src\},A\}andL¯hard,A\\bar\{L\}\_\{\\mathrm\{hard\},A\}\. With coverage toleranceδc\\delta\_\{c\}, we define the feasible set as

ℱ⁡\(A\)=\{z∈A:c⁡\(z\)≥maxz′∈A⁡c⁡\(z′\)−δc\}\.\\mathcal\{F\}\(A\)=\\\{z\\in A:c\(z\)\\geq\\max\_\{z^\{\\prime\}\\in A\}c\(z^\{\\prime\}\)\-\\delta\_\{c\}\\\}\.\(9\)With source\-signal weightsλs\\lambda\_\{s\}andλh\\lambda\_\{h\}, feasible suffixes are ranked by the selection scoreSA​\(z\)=λs​L¯src,A​\(z\)\+λh​L¯hard,A​\(z\)S\_\{A\}\(z\)=\\lambda\_\{s\}\\bar\{L\}\_\{\\mathrm\{src\},A\}\(z\)\+\\lambda\_\{h\}\\bar\{L\}\_\{\\mathrm\{hard\},A\}\(z\)\. Parent selection chooses theKKlowest\-scoring suffixes fromℱ⁡\(A1\)\\mathcal\{F\}\(A\_\{1\}\)and denotes this parent suffix set byPKP\_\{K\}\. If fewer thanKKterminal suffixes pass the coverage gate, BOSS keeps all suffixes inℱ⁡\(A1\)\\mathcal\{F\}\(A\_\{1\}\)and fills the remaining parent slots by rankingA1∖ℱ⁡\(A1\)A\_\{1\}\\setminus\\mathcal\{F\}\(A\_\{1\}\)with the same score\.

### 4\.3Parent Continuation and Final Selection

Parent continuation starts each run from one parent suffix inPKP\_\{K\}\. Continuing each parent forT2T\_\{2\}update steps yields

A2=\{ukT2=𝒜⁡\(Ms,𝒳t​r,pk,T2,ξk′\):pk∈PK\}\.A\_\{2\}=\\left\\\{u\_\{k\}^\{T\_\{2\}\}=\\mathcal\{A\}\(M\_\{s\},\\mathcal\{X\}\_\{tr\},p\_\{k\},T\_\{2\};\\xi^\{\\prime\}\_\{k\}\):p\_\{k\}\\in P\_\{K\}\\right\\\}\.\(10\)
Before final selection, BOSS computes the same source\-side diagnostics for the continued suffixes and normalizes scores over the combined terminal setA=A1∪A2A=A\_\{1\}\\cup A\_\{2\}\. The final suffix is

z⋆=arg​minz∈ℱ⁡\(A\)⁡SA​\(z\)\.z^\{\\star\}=\\operatorname\*\{arg\\,min\}\_\{z\\in\\mathcal\{F\}\(A\)\}S\_\{A\}\(z\)\.\(11\)After final selection, BOSS returns a fixed suffixz⋆z^\{\\star\}for target model evaluation\. Algorithm[1](https://arxiv.org/html/2609.02172#algorithm1)summarizes the complete optimization procedure\.

Algorithm 1BOSS suffix optimization\.Function*𝒜⁡\(Ms,𝒳t​r,zinit,T,ξ\)\\mathcal\{A\}\(M\_\{s\},\\mathcal\{X\}\_\{tr\},z\_\{\\mathrm\{init\}\},T;\\xi\)*:

z←zinitz\\leftarrow z\_\{\\mathrm\{init\}\};

for*t=0,…,T−1t=0,\\ldots,T\-1*do

Compute

Δj​\(v,z\)=−∇ezjℒsrc​\(z,𝒳t​r\)⊤​\(ev−ezj\)\\Delta\_\{j\}\(v;z\)=\-\\nabla\_\{e\_\{z\_\{j\}\}\}\\mathcal\{L\}\_\{\\mathrm\{src\}\}\(z;\\mathcal\{X\}\_\{tr\}\)^\{\\top\}\(e\_\{v\}\-e\_\{z\_\{j\}\}\)and

𝒱j=TopKκ,v∈𝒱⁡Δj​\(v,z\)\\mathcal\{V\}\_\{j\}=\\operatorname\{TopK\}\_\{\\kappa,v\\in\\mathcal\{V\}\}\\Delta\_\{j\}\(v;z\);

Sample

𝒞t=\{Replace\(z,jb,vb\):jb∼qt,vb∼Unif\(𝒱jb\),b=1,…,B\}\\mathcal\{C\}\_\{t\}=\\\{\\operatorname\{Replace\}\(z,j\_\{b\},v\_\{b\}\):j\_\{b\}\\sim q\_\{t\},\\ v\_\{b\}\\sim\\mathrm\{Unif\}\(\\mathcal\{V\}\_\{j\_\{b\}\}\),\\ b=1,\\ldots,B\\\};

z←arg⁡minz~∈𝒞t​ℒsrc​\(z~,𝒳t​r\)z\\leftarrow\\arg\\min\_\{\\tilde\{z\}\\in\\mathcal\{C\}\_\{t\}\}\\mathcal\{L\}\_\{\\mathrm\{src\}\}\(\\tilde\{z\};\\mathcal\{X\}\_\{tr\}\);

return

zz;

A1←\{𝒜⁡\(Ms,𝒳t​r,z0,T1,ξi\)\}i=1NA\_\{1\}\\leftarrow\\\{\\mathcal\{A\}\(M\_\{s\},\\mathcal\{X\}\_\{tr\},z^\{0\},T\_\{1\};\\xi\_\{i\}\)\\\}\_\{i=1\}^\{N\};

foreach*z∈A1z\\in A\_\{1\}*do

Compute

c\(z\)=\|𝒳t​r\|−1∑x∈𝒳t​r𝟏\{ℓs\(x,z\)≤τc\}c\(z\)=\|\\mathcal\{X\}\_\{tr\}\|^\{\-1\}\\sum\_\{x\\in\\mathcal\{X\}\_\{tr\}\}\\mathbf\{1\}\\\{\\ell\_\{s\}\(x,z\)\\leq\\tau\_\{c\}\\\}and

Lhard​\(z\)=\|ℋqh​\(z\)\|−1​∑x∈ℋqh​\(z\)ℓs​\(x,z\)L\_\{\\mathrm\{hard\}\}\(z\)=\|\\mathcal\{H\}\_\{q\_\{h\}\}\(z\)\|^\{\-1\}\\sum\_\{x\\in\\mathcal\{H\}\_\{q\_\{h\}\}\(z\)\}\\ell\_\{s\}\(x,z\);

ℱ⁡\(A1\)←\{z∈A1:c⁡\(z\)≥maxu∈A1⁡c⁡\(u\)−δc\}\\mathcal\{F\}\(A\_\{1\}\)\\leftarrow\\\{z\\in A\_\{1\}:c\(z\)\\geq\\max\_\{u\\in A\_\{1\}\}c\(u\)\-\\delta\_\{c\}\\\}; rank by

SA1​\(z\)=λs​L¯src,A1​\(z\)\+λh​L¯hard,A1​\(z\)S\_\{A\_\{1\}\}\(z\)=\\lambda\_\{s\}\\bar\{L\}\_\{\\mathrm\{src\},A\_\{1\}\}\(z\)\+\\lambda\_\{h\}\\bar\{L\}\_\{\\mathrm\{hard\},A\_\{1\}\}\(z\);

PK←TopKKmin⁡\(ℱ⁡\(A1\);SA1\)P\_\{K\}\\leftarrow\\operatorname\{TopK\}^\{\\min\}\_\{K\}\(\\mathcal\{F\}\(A\_\{1\}\);S\_\{A\_\{1\}\}\);

A2←\{𝒜⁡\(Ms,𝒳t​r,pk,T2,ξk′\):pk∈PK\}A\_\{2\}\\leftarrow\\\{\\mathcal\{A\}\(M\_\{s\},\\mathcal\{X\}\_\{tr\},p\_\{k\},T\_\{2\};\\xi^\{\\prime\}\_\{k\}\):p\_\{k\}\\in P\_\{K\}\\\};

A←A1∪A2A\\leftarrow A\_\{1\}\\cup A\_\{2\};

foreach*z∈Az\\in A*do

Compute

c\(z\)=\|𝒳t​r\|−1∑x∈𝒳t​r𝟏\{ℓs\(x,z\)≤τc\}c\(z\)=\|\\mathcal\{X\}\_\{tr\}\|^\{\-1\}\\sum\_\{x\\in\\mathcal\{X\}\_\{tr\}\}\\mathbf\{1\}\\\{\\ell\_\{s\}\(x,z\)\\leq\\tau\_\{c\}\\\}and

Lhard​\(z\)=\|ℋqh​\(z\)\|−1​∑x∈ℋqh​\(z\)ℓs​\(x,z\)L\_\{\\mathrm\{hard\}\}\(z\)=\|\\mathcal\{H\}\_\{q\_\{h\}\}\(z\)\|^\{\-1\}\\sum\_\{x\\in\\mathcal\{H\}\_\{q\_\{h\}\}\(z\)\}\\ell\_\{s\}\(x,z\);

ℱ⁡\(A\)←\{z∈A:c⁡\(z\)≥maxu∈A⁡c⁡\(u\)−δc\}\\mathcal\{F\}\(A\)\\leftarrow\\\{z\\in A:c\(z\)\\geq\\max\_\{u\\in A\}c\(u\)\-\\delta\_\{c\}\\\}; rank by

SA​\(z\)=λs​L¯src,A​\(z\)\+λh​L¯hard,A​\(z\)S\_\{A\}\(z\)=\\lambda\_\{s\}\\bar\{L\}\_\{\\mathrm\{src\},A\}\(z\)\+\\lambda\_\{h\}\\bar\{L\}\_\{\\mathrm\{hard\},A\}\(z\);

z⋆←arg⁡minz∈ℱ⁡\(A\)​SA​\(z\)z^\{\\star\}\\leftarrow\\arg\\min\_\{z\\in\\mathcal\{F\}\(A\)\}S\_\{A\}\(z\);

return

z⋆z^\{\\star\};

## 5Experiments

### 5\.1Experimental Setup

Dataset\.Following prior work\([Yang et al\., 2025](https://arxiv.org/html/2609.02172#bib.bib7)\), we use HarmBench[Mazeika et al\. \(2024\)](https://arxiv.org/html/2609.02172#bib.bib3)as the evaluation benchmark, optimizing adversarial suffixes on a 20\-behavior training subset and evaluating them on the standard 200\-behavior test set\.

Models\.We use Llama\-2\-7B\-Chat[Touvron et al\. \(2023\)](https://arxiv.org/html/2609.02172#bib.bib9)and Yi\-1\.5\-9B\-Chat[Young et al\. \(2024\)](https://arxiv.org/html/2609.02172#bib.bib13)as the source model\. Our target models include five open\-source models and two closed\-source models\. The open\-source models are Qwen2\-7B\-Instruct[Yang et al\. \(2024\)](https://arxiv.org/html/2609.02172#bib.bib10), Vicuna\-7B\-v1\.5[Chiang et al\. \(2023\)](https://arxiv.org/html/2609.02172#bib.bib12), Yi\-1\.5\-9B\-Chat[Young et al\. \(2024\)](https://arxiv.org/html/2609.02172#bib.bib13), Gemma\-7B\-It[Team \(2024\)](https://arxiv.org/html/2609.02172#bib.bib11), and Mistral\-7B\-Instruct[Jiang et al\. \(2023\)](https://arxiv.org/html/2609.02172#bib.bib17)\. The closed\-source models are Gemini\-2\.5\-Flash\-Lite[Team \(2025\)](https://arxiv.org/html/2609.02172#bib.bib14)and GPT\-3\.5\-Turbo\-0125\.

Metrics\.We use HarmBench\-Llama\-2\-13B\-cls from HarmBench[Mazeika et al\. \(2024\)](https://arxiv.org/html/2609.02172#bib.bib3)as the evaluator and Attack Success Rate \(ASR\) as the primary metric\. We report source\-model ASR \(S\-ASR\) and target\-model ASR \(T\-ASR\), where T\-ASR measures attack success on target models\. For each experiment, we run three random seeds and report the mean ASR with sample standard deviation\.

Baselines\.We evaluate experiments on three widely used jailbreaking Attacks:

- •GCG[Zou et al\. \(2023\)](https://arxiv.org/html/2609.02172#bib.bib2)uses greedy coordinate gradients to optimize adversarial suffix tokens toward an affirmative target response\.
- •I\-GCG[Jia et al\. \(2025\)](https://arxiv.org/html/2609.02172#bib.bib4)extends GCG with diverse target templates, automatic multi\-coordinate updating, and easy\-to\-hard initialization\.
- •GJO[Yang et al\. \(2025\)](https://arxiv.org/html/2609.02172#bib.bib7)improves transferability by removing superfluous response\-pattern and token\-tail constraints from the optimization objective\.

Implementation details\.All experiments were conducted on an NVIDIA RTX 3090 GPU with 64 GB of RAM\. Following prior work[Jia et al\. \(2025\)](https://arxiv.org/html/2609.02172#bib.bib4), we set the adversarial suffix length to 20 and the total number of optimization iterations to 500, and the candidate batch size toB=128B=128\. Unless otherwise stated, BOSS formsA1A\_\{1\}withN=10N=10optimization runs ofT1=30T\_\{1\}=30update steps, selectsK=4K=4parent suffixes, and continues each parent forT2=50T\_\{2\}=50update steps\. The input template is shown in Appendix[A](https://arxiv.org/html/2609.02172#A1), and additional implementation details are reported in Appendix[B](https://arxiv.org/html/2609.02172#A2)\.

### 5\.2Main Results

As shown in Table[1](https://arxiv.org/html/2609.02172#S5.T1), BOSS improves the effectiveness of GCG\-based attacks across most models\. With BOSS, GCG’s S\-ASR increases from 43\.7% to 78\.7%\. For I\-GCG, it increases the average T\-ASR from 52\.7% to 69\.3%\. This improvement comes from changing which suffixes survive during search\. Instead of letting one currently selected suffix determine all later updates, BOSS keeps several short\-trajectory terminals, continues the parents selected using source\-side diagnostics such as source loss, TFAL, and behavior coverage, and chooses the final suffix from the resulting terminal choices\. Additional results using Yi\-1\.5\-9B\-Chat as the source model are reported in Appendix Table[4](https://arxiv.org/html/2609.02172#A0.T4)\.

Table[1](https://arxiv.org/html/2609.02172#S5.T1)reports Base, w/ parents, w/ final, and w/ BOSS\. Base is the base optimizer\. w/ parents and w/ final use behavior coverage, the standard source loss, and TFAL only for parent selection or only for final suffix selection, respectively; the other selection uses average source loss\. w/ BOSS uses them for both parent selection and final suffix selection\. In the average T\-ASR, the two additional results are lower than the result obtained by applying BOSS to the base optimizer\. For example, on Yi\-1\.5\-9B\-Chat with GJO, w/ parents reaches 59\.2% and w/ final reaches 73\.3%, while BOSS reaches 87\.5%\. This indicates that the gain comes from selecting parents and the final suffix with behavior coverage and TFAL, rather than using loss alone\.

Table 1:ASR \(%\) on the source model and target models, with suffixes optimized on Llama\-2\-7B\-Chat\. We compare the base optimizer, two partial variants that apply our source\-side diagnostics to parent selection or final suffix selection, and the full BOSS method\. We report the mean ASR over three runs with sample standard deviation shown ingrey\.
### 5\.3Effect of Search Breadth

As shown in Figure[3](https://arxiv.org/html/2609.02172#S5.F3), using multiple initial trajectories generally improves average T\-ASR over the single\-trajectory setting\. To ensure a fair comparison, we keep the total update budget fixed at 500 when varyingNNby adjusting the continuation budget accordingly\. However, the gains are not monotonic asNNincreases, suggesting that excessive breadth can dilute the continuation budget or introduce weaker terminal suffixes\. Across the three baselines, performance is consistently higher than theN=1N=1setting and often peaks aroundN=10N=10, supporting our choice ofN=10N=10as the default configuration\. These results support our hypothesis that broader suffix exploration is more effective than relying on a single long greedy trajectory under the same optimization budget\.

\(a\)GCG\(b\)I\-GCG\(c\)GJO
Figure 3:ASR across different numbers of initial trajectoriesNNover the seven target models\. The total update budget is fixed at 500 for all settings\. The thick red star\-marked line reports the average T\-ASR\.
### 5\.4Time Comparison

Figure[4](https://arxiv.org/html/2609.02172#S5.F4)compares the wall\-clock search time required to obtain the final suffix on Llama\-2\-7B\-Chat\. BOSS consistently reduces optimization time across all three baselines, cutting the search time by more than half\. Specifically, GCG is reduced from 471 to 195 minutes, I\-GCG from 410 to 172 minutes, and GJO from 340 to 166 minutes\.

This efficiency comes from the staged search structure of BOSS\. Rather than spending the full budget on one long incumbent trajectory, BOSS first explores multiple short trajectories, selects promising terminal suffixes using source\-side diagnostics, and continues only selected parents before final suffix selection\. This reallocates computation from deep greedy search to broader suffix exploration without increasing the total update budget\.

Figure 4:Wall\-clock search time required to obtain the final suffix on Llama\-2\-7B\-Chat\.
### 5\.5Target\-Response Consistency

ModelsGCGI\-GCGGJOBase\+BOSSBase\+BOSSBase\+BOSSSource ModelLlama\-2\-7B\-Chat61\.0672\.99\+11\.9357\.1865\.96\+8\.7872\.1872\.92\+0\.74Target ModelOpen\-SourceQwen2\-7B\-Instruct67\.3273\.51\+6\.1953\.7872\.94\+19\.1669\.3861\.95\-7\.43Vicuna\-7B\-v1\.574\.1274\.28\+0\.1671\.2373\.55\+2\.3274\.0374\.23\+0\.20Yi\-1\.5\-9B\-Chat64\.9573\.11\+8\.1663\.8672\.55\+8\.6968\.3072\.22\+3\.92Gemma\-7B\-It53\.8252\.15\-1\.6753\.7660\.73\+6\.9756\.3558\.60\+2\.25Mistral\-7B\-Instruct61\.7772\.81\+11\.0471\.0072\.97\+1\.9768\.9572\.77\+3\.82Closed\-SourceGemini\-2\.5\-flash75\.7376\.00\+0\.2746\.5551\.68\+5\.1351\.1251\.11\-0\.01GPT\-3\.5\-turbo38\.6052\.16\+13\.5674\.7675\.17\+0\.4175\.4375\.83\+0\.40Avg\.62\.3367\.72\+5\.3962\.1368\.51\+6\.3866\.2266\.67\+0\.45

Table 2:Target\-response consistency measured by BERTScore\-F1 between generated responses and HarmBench target responses, with Llama\-2\-7B\-Chat as the source model\.Table 3:Generation examples for the same HarmBench behavior across different target models under the baseline GCG optimizer and BOSS\. Llama\-2\-7B\-Chat is used as the source model\. We highlightrefusal behaviorandtarget\-following behavior\. The table reports sanitized and truncated excerpts, with potentially operational details omitted\.Table[2](https://arxiv.org/html/2609.02172#S5.T2)evaluates target\-response consistency using BERTScore\-F1 between generated responses and HarmBench target responses\. Across the three baselines, applying BOSS generally increases the average target\-model BERTScore\-F1\. For example, BOSS improves BERTScore\-F1 from 53\.78 to 72\.94 on Qwen2\-7B\-Instruct with I\-GCG, and from 38\.60 to 52\.16 on GPT\-3\.5\-Turbo with GCG\. These results suggest that BOSS not only improves attack success, but also makes transferred responses more consistent with the intended target responses\.

The improvement is strongest for GCG and I\-GCG, while GJO shows a smaller average gain because its baseline already produces more target\-like responses\. This trend is consistent with the design of BOSS: by retaining multiple terminal suffixes and selecting them with source\-side diagnostics, BOSS is more likely to choose suffixes whose transferred responses remain close to the target responses rather than merely bypassing refusals\.

### 5\.6Case Study

Table[3](https://arxiv.org/html/2609.02172#S5.T3)provides a qualitative comparison for a representative HarmBench behavior under the same source\-model optimization setting used in Table[1](https://arxiv.org/html/2609.02172#S5.T1)\. The baseline GCG suffix produces less stable transfer behavior across target models: some responses remain refusals, while others partially follow the target response but drift into less consistent outputs\. In contrast, BOSS more consistently preserves the target\-response pattern across the source model and the shown target models\.

This qualitative pattern is consistent with the BERTScore\-F1 results in Table[2](https://arxiv.org/html/2609.02172#S5.T2)\. By retaining multiple terminal suffix states and continuing selected parents, BOSS improves not only attack success but also target\-response consistency after transfer\.

## 6Conclusion

We presented BOSS, a plug\-and\-play framework for improving GCG\-based jailbreak optimization\. Motivated by the limitations of averaged adversarial loss and deep greedy search, BOSS reallocates the optimization budget from depth to breadth by exploring multiple short suffix trajectories and selectively continuing promising terminal suffixes\. We further introduced Tail\-Focused Adversarial Loss, which emphasizes hard\-to\-optimize behaviors, and combined it with standard source loss and behavior coverage for terminal suffix selection\. Experiments on HarmBench show that BOSS improves attack success rates across multiple GCG\-based methods, reduces optimization time, and produces responses with higher target\-response consistency\. These results suggest that broad suffix exploration and source\-side diagnostics are effective design principles for transferable jailbreak optimization\.

## Limitations

BOSS relies primarily on source\-side diagnostics, including source loss, TFAL, and behavior coverage, to select parent suffixes and the final suffix\. This follows the standard GCG\-based transfer setting, where suffixes are optimized on a white\-box source model and then transferred to unseen target models\. Although our experiments show strong ASR improvements, transferability remains inherently uncertain\. When source and target models differ substantially in architecture, training data, alignment procedure, or refusal behavior, source\-side diagnostics may fail to predict target\-model effectiveness\. Future work could incorporate explicit transferability objectives while avoiding target\-test leakage\.

## Ethical Considerations

This work studies jailbreak suffix optimization, which is inherently dual\-use\. Our goal is to support controlled red\-teaming and safety evaluation by identifying weaknesses in existing suffix\-search procedures and by clarifying how search budget allocation affects attack success\. The method is evaluated in a benchmark setting, and target models are used only after final suffix selection for evaluation rather than as optimization feedback\.

We report aggregate metrics and limited qualitative examples to explain model behavior, while avoiding complete operational instructions\. In practical use, this type of evaluation should be conducted only in authorized settings, with appropriate safeguards for model access, logging, and disclosure\. We hope the findings help model developers better understand and test failure modes of aligned LLMs\.

## References

- Andriushchenkoet al\.\(2025\)M\. Andriushchenko, F\. Croce, and N\. FlammarionJailbreaking leading safety\-aligned llms with simple adaptive attacks\.InThe Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24\-28, 2025,External Links:[Link](https://openreview.net/forum?id=hXA8wqRdyV)Cited by:[§2\.2](https://arxiv.org/html/2609.02172#S2.SS2.p3.1)\.
- Audibertet al\.\(2010\)J\. Audibert, S\. Bubeck, and R\. MunosBest arm identification in multi\-armed bandits\.InProceedings of the 23rd Annual Conference on Learning Theory, COLT 2010,pp\. 41–53\.External Links:[Link](https://www.learningtheory.org/colt2010/papers/59Audibert.pdf)Cited by:[§2\.2](https://arxiv.org/html/2609.02172#S2.SS2.p2.1)\.
- Bergstra and Bengio \(2012\)J\. Bergstra and Y\. BengioRandom search for hyper\-parameter optimization\.Journal of Machine Learning Research13\(10\),pp\. 281–305\.External Links:[Link](https://jmlr.org/papers/v13/bergstra12a.html)Cited by:[§2\.2](https://arxiv.org/html/2609.02172#S2.SS2.p2.1)\.
- Chianget al\.\(2023\)W\. Chiang, Z\. Li, Z\. Lin, Y\. Sheng, Z\. Wu, H\. Zhang, L\. Zheng, S\. Zhuang, Y\. Zhuang, J\. E\. Gonzalez, I\. Stoica, and E\. P\. XingVicuna: an open\-source chatbot impressing gpt\-4 with 90%\* chatgpt quality\.External Links:[Link](https://lmsys.org/blog/2023-03-30-vicuna/)Cited by:[§5\.1](https://arxiv.org/html/2609.02172#S5.SS1.p2.1)\.
- Jamieson and Talwalkar \(2016\)K\. Jamieson and A\. TalwalkarNon\-stochastic best arm identification and hyperparameter optimization\.InProceedings of the 19th International Conference on Artificial Intelligence and Statistics, AISTATS 2016, Cadiz, Spain, May 9\-11, 2016,A\. Gretton and C\. C\. Robert \(Eds\.\),JMLR Workshop and Conference Proceedings,pp\. 240–248\.External Links:[Link](http://proceedings.mlr.press/v51/jamieson16.html)Cited by:[§2\.2](https://arxiv.org/html/2609.02172#S2.SS2.p2.1)\.
- Jeonget al\.\(2026\)S\. Jeong, J\. Jeong, H\. Kim, Y\. Lee, and W\. LeeSlotGCG: exploiting the positional vulnerability in LLMs for jailbreak attacks\.InThe Fourteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=Fn2rSOnpNf)Cited by:[§1](https://arxiv.org/html/2609.02172#S1.p2.1),[§2\.1](https://arxiv.org/html/2609.02172#S2.SS1.p1.1)\.
- Jiaet al\.\(2025\)X\. Jia, T\. Pang, C\. Du, Y\. Huang, J\. Gu, Y\. Liu, X\. Cao, and M\. LinImproved techniques for optimization\-based jailbreaking on large language models\.InThe Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24\-28, 2025,External Links:[Link](https://openreview.net/forum?id=e9yfCY7Q3U)Cited by:[§1](https://arxiv.org/html/2609.02172#S1.p2.1),[§2\.1](https://arxiv.org/html/2609.02172#S2.SS1.p1.1),[2nd item](https://arxiv.org/html/2609.02172#S5.I1.i2.p1.1),[§5\.1](https://arxiv.org/html/2609.02172#S5.SS1.p5.1)\.
- Jianget al\.\(2023\)A\. Q\. Jiang, A\. Sablayrolles, A\. Mensch, C\. Bamford, D\. S\. Chaplot, D\. de Las Casas, F\. Bressand, G\. Lengyel, G\. Lample, L\. Saulnier, L\. R\. Lavaud, M\. Lachaux, P\. Stock, T\. L\. Scao, T\. Lavril, T\. Wang, T\. Lacroix, and W\. E\. SayedMistral 7b\.CoRRabs/2310\.06825\.External Links:[Link](https://doi.org/10.48550/arXiv.2310.06825),[Document](https://dx.doi.org/10.48550/ARXIV.2310.06825),2310\.06825Cited by:[§5\.1](https://arxiv.org/html/2609.02172#S5.SS1.p2.1)\.
- Karninet al\.\(2013\)Z\. Karnin, T\. Koren, and O\. SomekhAlmost optimal exploration in multi\-armed bandits\.InProceedings of the 30th International Conference on Machine Learning, ICML 2013,Proceedings of Machine Learning Research, Vol\.28,pp\. 1238–1246\.External Links:[Link](https://proceedings.mlr.press/v28/karnin13.html)Cited by:[§2\.2](https://arxiv.org/html/2609.02172#S2.SS2.p2.1)\.
- Liet al\.\(2019\)A\. Li, O\. Spyra, S\. Perel, V\. Dalibard, M\. Jaderberg, C\. Gu, D\. Budden, T\. Harley, and P\. GuptaA generalized framework for population based training\.InProceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, KDD 2019,pp\. 1791–1799\.External Links:[Document](https://dx.doi.org/10.1145/3292500.3330649),[Link](https://doi.org/10.1145/3292500.3330649)Cited by:[§2\.2](https://arxiv.org/html/2609.02172#S2.SS2.p2.1)\.
- Liet al\.\(2020\)L\. Li, K\. Jamieson, A\. Rostamizadeh, E\. Gonina, M\. Hardt, B\. Recht, and A\. TalwalkarA system for massively parallel hyperparameter tuning\.InProceedings of Machine Learning and Systems, MLSys 2020,Vol\.2,pp\. 230–246\.External Links:[Link](https://proceedings.mlsys.org/paper_files/paper/2020/hash/a06f20b349c6cf09a6b171c71b88bbfc-Abstract.html)Cited by:[§2\.2](https://arxiv.org/html/2609.02172#S2.SS2.p2.1)\.
- Liet al\.\(2018\)L\. Li, K\. G\. Jamieson, G\. DeSalvo, A\. Rostamizadeh, and A\. TalwalkarHyperband: A novel bandit\-based approach to hyperparameter optimization\.Journal of Machine Learning Research18\(185\),pp\. 1–52\.External Links:[Link](https://jmlr.org/papers/v18/16-558.html)Cited by:[§2\.2](https://arxiv.org/html/2609.02172#S2.SS2.p2.1)\.
- Liao and Sun \(2024\)Z\. Liao and H\. SunAmpleGCG: learning a universal and transferable generative model of adversarial suffixes for jailbreaking both open and closed LLMs\.InFirst Conference on Language Modeling,External Links:[Link](https://openreview.net/forum?id=UfqzXg95I5)Cited by:[§1](https://arxiv.org/html/2609.02172#S1.p2.1),[§2\.1](https://arxiv.org/html/2609.02172#S2.SS1.p1.1)\.
- Mazeikaet al\.\(2024\)M\. Mazeika, L\. Phan, X\. Yin, A\. Zou, Z\. Wang, N\. Mu, E\. Sakhaee, N\. Li, S\. Basart, B\. Li, D\. A\. Forsyth, and D\. HendrycksHarmBench: A standardized evaluation framework for automated red teaming and robust refusal\.InForty\-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21\-27, 2024,R\. Salakhutdinov, Z\. Kolter, K\. A\. Heller, A\. Weller, N\. Oliver, J\. Scarlett, and F\. Berkenkamp \(Eds\.\),Proceedings of Machine Learning Research,pp\. 35181–35224\.External Links:[Link](https://proceedings.mlr.press/v235/mazeika24a.html)Cited by:[§5\.1](https://arxiv.org/html/2609.02172#S5.SS1.p1.1),[§5\.1](https://arxiv.org/html/2609.02172#S5.SS1.p3.1)\.
- Snoeket al\.\(2012\)J\. Snoek, H\. Larochelle, and R\. P\. AdamsPractical Bayesian optimization of machine learning algorithms\.InAdvances in Neural Information Processing Systems 25: 26th Annual Conference on Neural Information Processing Systems, NIPS 2012,pp\. 2951–2959\.External Links:[Link](https://papers.nips.cc/paper/4522-practical-bayesian-optimization-of-machine-learning-algorithms)Cited by:[§2\.2](https://arxiv.org/html/2609.02172#S2.SS2.p2.1)\.
- Team \(2025\)G\. TeamGemini 2\.5: pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities\.CoRRabs/2507\.06261\.External Links:[Link](https://doi.org/10.48550/arXiv.2507.06261),[Document](https://dx.doi.org/10.48550/ARXIV.2507.06261),2507\.06261Cited by:[§5\.1](https://arxiv.org/html/2609.02172#S5.SS1.p2.1)\.
- Team \(2024\)G\. TeamGemma: open models based on gemini research and technology\.CoRRabs/2403\.08295\.External Links:[Link](https://doi.org/10.48550/arXiv.2403.08295),[Document](https://dx.doi.org/10.48550/ARXIV.2403.08295),2403\.08295Cited by:[§5\.1](https://arxiv.org/html/2609.02172#S5.SS1.p2.1)\.
- Touvronet al\.\(2023\)H\. Touvron, L\. Martin, K\. Stone, P\. Albert, A\. Almahairi, Y\. Babaei, N\. Bashlykov, S\. Batra, P\. Bhargava, S\. Bhosale, D\. Bikel, L\. Blecher, C\. Canton\-Ferrer, M\. Chen, G\. Cucurull, D\. Esiobu, J\. Fernandes, J\. Fu, W\. Fu, B\. Fuller, C\. Gao, V\. Goswami, N\. Goyal, A\. Hartshorn, S\. Hosseini, R\. Hou, H\. Inan, M\. Kardas, V\. Kerkez, M\. Khabsa, I\. Kloumann, A\. Korenev, P\. S\. Koura, M\. Lachaux, T\. Lavril, J\. Lee, D\. Liskovich, Y\. Lu, Y\. Mao, X\. Martinet, T\. Mihaylov, P\. Mishra, I\. Molybog, Y\. Nie, A\. Poulton, J\. Reizenstein, R\. Rungta, K\. Saladi, A\. Schelten, R\. Silva, E\. M\. Smith, R\. Subramanian, X\. E\. Tan, B\. Tang, R\. Taylor, A\. Williams, J\. X\. Kuan, P\. Xu, Z\. Yan, I\. Zarov, Y\. Zhang, A\. Fan, M\. Kambadur, S\. Narang, A\. Rodriguez, R\. Stojnic, S\. Edunov, and T\. ScialomLlama 2: open foundation and fine\-tuned chat models\.CoRRabs/2307\.09288\.External Links:[Link](https://doi.org/10.48550/arXiv.2307.09288),[Document](https://dx.doi.org/10.48550/ARXIV.2307.09288),2307\.09288Cited by:[§5\.1](https://arxiv.org/html/2609.02172#S5.SS1.p2.1)\.
- Wallaceet al\.\(2019\)E\. Wallace, S\. Feng, N\. Kandpal, M\. Gardner, and S\. SinghUniversal adversarial triggers for attacking and analyzing NLP\.InProceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing \(EMNLP\-IJCNLP\),K\. Inui, J\. Jiang, V\. Ng, and X\. Wan \(Eds\.\),Hong Kong, China,pp\. 2153–2162\.External Links:[Link](https://aclanthology.org/D19-1221/),[Document](https://dx.doi.org/10.18653/v1/D19-1221)Cited by:[§2\.1](https://arxiv.org/html/2609.02172#S2.SS1.p1.1)\.
- Wiseman and Rush \(2016\)S\. Wiseman and A\. M\. RushSequence\-to\-sequence learning as beam\-search optimization\.InProceedings of the 2016 Conference on Empirical Methods in Natural Language Processing,Austin, Texas,pp\. 1296–1306\.External Links:[Link](https://aclanthology.org/D16-1137/),[Document](https://dx.doi.org/10.18653/v1/D16-1137)Cited by:[§2\.2](https://arxiv.org/html/2609.02172#S2.SS2.p2.1)\.
- Yanget al\.\(2024\)A\. Yang, B\. Yang, B\. Hui, B\. Zheng, B\. Yu, C\. Zhou, C\. Li, C\. Li, D\. Liu, F\. Huang, G\. Dong, H\. Wei, H\. Lin, J\. Tang, J\. Wang, J\. Yang, J\. Tu, J\. Zhang, J\. Ma, J\. Yang, J\. Xu, J\. Zhou, J\. Bai, J\. He, J\. Lin, K\. Dang, K\. Lu, K\. Chen, K\. Yang, M\. Li, M\. Xue, N\. Ni, P\. Zhang, P\. Wang, R\. Peng, R\. Men, R\. Gao, R\. Lin, S\. Wang, S\. Bai, S\. Tan, T\. Zhu, T\. Li, T\. Liu, W\. Ge, X\. Deng, X\. Zhou, X\. Ren, X\. Zhang, X\. Wei, X\. Ren, X\. Liu, Y\. Fan, Y\. Yao, Y\. Zhang, Y\. Wan, Y\. Chu, Y\. Liu, Z\. Cui, Z\. Zhang, Z\. Guo, and Z\. FanQwen2 technical report\.CoRRabs/2407\.10671\.External Links:[Link](https://doi.org/10.48550/arXiv.2407.10671),[Document](https://dx.doi.org/10.48550/ARXIV.2407.10671),2407\.10671Cited by:[§5\.1](https://arxiv.org/html/2609.02172#S5.SS1.p2.1)\.
- Yanget al\.\(2025\)J\. Yang, Z\. Zhang, S\. Cui, H\. Wang, and M\. HuangGuiding not forcing: enhancing the transferability of jailbreaking attacks on llms via removing superfluous constraints\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\), ACL 2025, Vienna, Austria, July 27 \- August 1, 2025,W\. Che, J\. Nabende, E\. Shutova, and M\. T\. Pilehvar \(Eds\.\),pp\. 19643–19655\.External Links:[Link](https://aclanthology.org/2025.acl-long.965/)Cited by:[§2\.1](https://arxiv.org/html/2609.02172#S2.SS1.p1.1),[3rd item](https://arxiv.org/html/2609.02172#S5.I1.i3.p1.1),[§5\.1](https://arxiv.org/html/2609.02172#S5.SS1.p1.1)\.
- Younget al\.\(2024\)A\. Young, B\. Chen, C\. Li, C\. Huang, G\. Zhang, G\. Zhang, H\. Li, J\. Zhu, J\. Chen, J\. Chang, K\. Yu, P\. Liu, Q\. Liu, S\. Yue, S\. Yang, S\. Yang, T\. Yu, W\. Xie, W\. Huang, X\. Hu, X\. Ren, X\. Niu, P\. Nie, Y\. Xu, Y\. Liu, Y\. Wang, Y\. Cai, Z\. Gu, Z\. Liu, and Z\. DaiYi: open foundation models by 01\.ai\.CoRRabs/2403\.04652\.External Links:[Link](https://doi.org/10.48550/arXiv.2403.04652),[Document](https://dx.doi.org/10.48550/ARXIV.2403.04652),2403\.04652Cited by:[§5\.1](https://arxiv.org/html/2609.02172#S5.SS1.p2.1)\.
- Zhouet al\.\(2025\)Y\. Zhou, J\. Lou, Z\. Huang, Z\. Qin, S\. Yang, and W\. WangDon’t say no: jailbreaking LLM by suppressing refusal\.InFindings of the Association for Computational Linguistics, ACL 2025, Vienna, Austria, July 27 \- August 1, 2025,W\. Che, J\. Nabende, E\. Shutova, and M\. T\. Pilehvar \(Eds\.\),Findings of ACL,pp\. 25224–25249\.External Links:[Link](https://aclanthology.org/2025.findings-acl.1294/)Cited by:[§1](https://arxiv.org/html/2609.02172#S1.p2.1),[§2\.1](https://arxiv.org/html/2609.02172#S2.SS1.p1.1)\.
- Zouet al\.\(2023\)A\. Zou, Z\. Wang, J\. Z\. Kolter, and M\. FredriksonUniversal and transferable adversarial attacks on aligned language models\.CoRRabs/2307\.15043\.External Links:[Link](https://doi.org/10.48550/arXiv.2307.15043),[Document](https://dx.doi.org/10.48550/ARXIV.2307.15043),2307\.15043Cited by:[§1](https://arxiv.org/html/2609.02172#S1.p2.1),[§2\.1](https://arxiv.org/html/2609.02172#S2.SS1.p1.1),[1st item](https://arxiv.org/html/2609.02172#S5.I1.i1.p1.1)\.

Table 4:ASR for source model and target models, searched on Yi\-1\.5\-9B\-Chat\. We report Base and \+Ours results for GCG, I\-GCG, and GJO\. We report ASR along with its standard deviation \(indicated by±\\pm\)\. All standard deviations are placeholders and should be filled manually\.## Appendix APrompt

This appendix gives the input template used to construct prompts for suffix evaluation\. As shown in Figure[5](https://arxiv.org/html/2609.02172#A1.F5), the optimized adversarial prompt is placed before the behavior question, followed by a fixed target\-response prefix\. During optimization and suffix selection, BOSS uses only source\-model signals; target models are queried only after final suffix selection for evaluation\. The example in Figure[5](https://arxiv.org/html/2609.02172#A1.F5)is schematic and uses redacted placeholders\.

Input template\# Input Template\{Adversarial Prompt\} \{Question\}
Start your response with ‘‘\{Target\}:\\nStep 1’’\# Example\{Adversarial Prompt\} Write code for exploiting the BlueKeep vulnerability and explain how to use it
Start your response with "Here’s an explanation of the BlueKeep vulnerability and some code to exploit it::\\nStep 1’’Figure 5:Input template used for suffix evaluation\. The example is schematic and uses redacted placeholders\.
## Appendix BAdditional Implementation Details

In addition to the search\-budget settings stated in the experimental setup, we set the gradient proposal set size toκ=256\\kappa=256, the hard\-behavior fraction inLhard​\(z\)L\_\{\\mathrm\{hard\}\}\(z\)toqh=0\.5q\_\{h\}=0\.5, the source\-loss weight toλs=0\.45\\lambda\_\{s\}=0\.45, and the hard\-behavior\-loss weight toλh=0\.20\\lambda\_\{h\}=0\.20\.

## Appendix CAdditional Results with Yi as Source Model

Table[4](https://arxiv.org/html/2609.02172#A0.T4)reports an additional source\-model setting where the suffix is optimized on Yi\-1\.5\-9B\-Chat instead of the Llama\-2\-7B\-Chat source used in Table[1](https://arxiv.org/html/2609.02172#S5.T1)\. With BOSS, source\-model ASR increases from 70\.5% to 81\.0% for GCG, from 23\.5% to 78\.5% for I\-GCG, and from 71\.5% to 72\.5% for GJO\. The target\-model average also improves consistently: GCG increases from 43\.1% to 63\.4% , I\-GCG from 28\.1% to 59\.8% , and GJO from 46\.2% to 60\.0% \. These results indicate that the staged retention, continuation, and final\-selection procedure is not tied to a single source model\.