Reasoning-based jailbreaking of models

A system comprising:

• one or more processors;
• and
• one or more computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• selecting, from a buffer, a first node comprising a loss value of a set of first loss values;
• generating, based on inputting the first node to a first LLM configured to generate attack prompts, first prompts configured to jailbreak a target model;
• receiving, based on inputting the first prompts to the target model, outputs from the target model;
• determining, based on a desired output and the outputs, whether a jailbreak of the target model is successful;
• and
• based on determining that the jailbreak is unsuccessful:
• generating, based on providing the first prompts as input to a second LLM configured to refine the attack prompts, feedback data for each of the first prompts;
• removing the first node from the buffer;
• for respective feedback data associated with each of the first prompts:
• generating, based on the feedback data, a child node of the first node;
• determining whether to store the child node in the buffer;
• and
• incrementing a counter;
• and
• selecting, from the buffer, a second node from the buffer.

One or more non-transitory computer-readable media storing instructions executable by one or more processors of a node, wherein the instructions, when executed, cause the one or more processors to perform operations comprising:

• selecting, from a buffer, a first node comprising a lowest loss value of a set of first loss values;
• generating, based on inputting the first node to a first LLM configured to generate attack prompts, first prompts configured to jailbreak a target model;
• receiving, based on inputting the first prompts to the target model, outputs from the target model;
• and
• based on determining whether a jailbreak of the target model is successful, performing an action.