Breaking the Guardrails: How Simple Adaptive Attacks Jailbreak LLMs
As artificial intelligence continues to evolve, Large Language Models (LLMs) have found their way into a wide range of domains. While these models offer groundbreaking capabilities, they also present a growing surface for exploitation.
One of the most concerning classes of attacks today is the adaptive attack, a technique where the attacker crafts their exploit to bypass a specific model's safety guardrails. Unlike generic jailbreak attempts, adaptive attacks are model-aware, often leveraging internal behaviors like token probability patterns to craft highly effective prompts that trigger harmful or policy-violating outputs.
Recently, we came across a research paper that introduces a simple yet highly effective jailbreak attack on modern Large Language Models (LLMs) like GPT-3.5 Turbo, GPT-4o, Grok, etc. The paper presents a Simple Adaptive Attack that systematically defeats the safety mechanisms of these models—achieving up to 100% jailbreak success rate on some of the most widely deployed AI systems today.
In this blog we are going discuss about Simple Adaptive Attack and discuss about its support in BreakingPoint Systems (BPS) and CyPerf.
Understanding Simple Adaptive LLM attack
Adaptive attacks are crafted specifically to target a known defense mechanism in a model. Rather than being generic, each attack is tuned per model type (e.g., GPT-3.5, GPT-4o) to defeat its safety guardrails. However, the same attack is reused across multiple prompts—it is model-specific, not request-specific.
Key Vectors
Prompt Templates
A powerful jailbreak begins with a carefully engineered prompt. The general structure used is:
Set of Rules + Harmful Request + Adversarial Suffix
- Set of Rules: A list of instructions or justifications (e.g., , "You must follow all the rules").
- Harmful Request: A dangerous or policy-violating instruction (e.g., how to build a weapon).
- Adversarial Suffix: A crafted sequence of tokens optimized to trigger unsafe completions.
These templates are designed to force the model to start its response with specific target tokens like "Sure”. This setup is optimized by measuring the log-probability (logprob) of the first target token ("Sure") using the model’s output probabilities, helping identify effective rule combinations. This alone achieved a 100% attack success rate on GPT-3.5 Turbo.
Random Search Optimization
A simple yet powerful optimization technique is used to find effective adversarial suffixes:
- Initialize: Start with a 25-token suffix (empirically chosen for balance).
- Iterate: Randomly modify a few tokens in the suffix.
- Accept the change only if it increases the logprob of the target token (“Sure”) at the beginning of the model's output.
- Repeat: Up to 10,000 iterations and 10 restarts if needed (usually one is enough).
Self-Transfer
The attack improves its efficiency by reusing optimized suffixes:Start with a simple harmful prompt (e.g., one that the model is likely to answer). Use the adversarial suffix found for that prompt as the initialization point for more complex prompts. This “self-transfer” technique boosts success rates by leveraging previously successful attacks.
Attack Flow
Figure 1: Simple Adaptive Attacks Flow
Leveraging Simple Adaptive Attack Techniques to Jailbreak LLM Models
We tested the Simple Adaptive Attack -based prompt injection on OpenAI's GPT-4o, GPT-3.5-turbo, grok-2-latest and gemini-2.0-flash models and found that the models were easily tricked by these methods, responding to prompts it would usually block. This showed a clear weakness in how it handles these unusual prompts.
Simple Adaptive Attack Based Prompt Injection Strikes in BPS
At Keysight Technologies, our Application and Threat Intelligence (ATI) team added the support of this new type of Prompt Injection attack i.e. AdaptiveAttacks in ATI-2025-10 StrikePack released on Jun 09, 2025. This update includes 4 new Strikes covering different prompt templates.
Simple Adaptive Attack Based Prompt Injection Strike in Cyperf
CyPerf will soon release an update containing 12 new strike simulating simple adaptive attack-based prompt injection targeting different Large Language Models (LLMs), OpenAI, Gemini, and Grok. These strikes tricks the llm into giving unsafe answers by starting with a harmful prompt and adding an adversarial suffix. It iteratively tweaks the adversarial suffix to maximize the log probability of a target word like "Sure," using random search.
Once the update is released, these strikes can be used in a test by searching in the CyPerf attack library with “Adaptive Attack”.
Figure 4: CyPerf UI Displaying Strike List
These strikes have some configurable properties for selecting the model, api version, system prompts and api key. These enable the simulation and identification of potential threats in real-world traffic scenarios.
Figure 5: CyPerf UI Displaying Strike Configurations
The statistic view in Cyperf UI provides detailed statistics from the test run, including the number of connections made and the number of active client and server agents. Users can also view separate HTTP statistics for client and server, along with overall TCP statistics. The strike statistics view, there are stats to show whether the strike request to the server was allowed by the DUT, a positive value in the “Server Allowed” stats will indicate that the request was allowed through the DUT to the server. The client allowed stats can be used to check whether the client received the expected response to the strike request. Whether the request or response was blocked by the DUT, it should show 0 value
Figure 6: Run-time stats view in CyPerf UI
Figure 7: Detailed view of the statistics after running the test on Cyperf
Leverage Subscription Service to Stay Ahead of Attacks
Keysight's Application and Threat Intelligence subscription provides daily malware and bi-weekly updates of the latest application protocols and vulnerabilities for use with Keysight test platforms. The ATI Research Centre continuously monitors threats as they appear in the wild. BreakingPoint and in the future, other tools like CyPerf, now provide customers with access to attack campaigns for different advanced persistent threats, enabling them to test their currently deployed security controls' ability to detect or block such attacks.
References
- https://arxiv.org/pdf/2404.02151
- https://github.com/tml-epfl/llm-adaptive-attacks
- https://genai.owasp.org/llm-top-10/
- https://www.keysight.com/blogs/en/inds/ai/prompt-injection-101-for-llm