Adversarial suffixes — the day the jailbreak was automated

What it is. Until this, a jailbreak was written — a human found a frame that worked. This paper found them by *gradient descent*. The Greedy Coordinate Gradient (GCG) attack searches, token by token, for a suffix — a short string of near-gibberish appended to a request — that maximizes the probability the model begins its answer with compliance (*“Sure, here is…”*). Optimized on open models where the gradients are visible (Vicuna, LLaMA-2), the resulting suffixes did two unwelcome things: they *generalized* across prompts (one string, many harmful requests) and they *transferred* across models — strings found on open weights jailbroke GPT-3.5, GPT-4, Claude, Bard, PaLM, systems whose internals the attacker never saw.

What it is — stated precisely. Not the first adversarial example (vision models had them for a decade) and not a claim that alignment is hopeless. It is a demonstration that jailbreaks are not a finite list of clever phrasings to be patched one by one — they are a *search space*, densely populated, machine-findable, and portable across the frontier. Patch the strings this paper published and the method finds more. That is a categorical shift: from a folk art with a bestiary to an automated, transferable attack surface.

Its place in this wing. It is the industrialization of the room. DAN and the grandma exploit were handcrafts; the Waluigi effect said the antagonist was always there to be reached; this proved you can reach it with an optimizer, at scale, without ever seeing the target model. For a collection built on verification, the lesson is stark: you cannot secure a model by enumerating the bad inputs, because the bad inputs are a continuous, transferable manifold, not a list. Defense has to live somewhere other than the input filter — which is the argument the whole verification half of this museum is built on.

*Primary source inside: Zou et al., “Universal and Transferable Adversarial Attacks on Aligned Language Models” (arXiv:2307.15043, 27 July 2023), introducing GCG and the transfer results.*