arXiv cs.CL· Yuanwei Wu, Lingdong Huang, Yunlong Mao, Kanye Ye Wang, Jingyu Hua, Sheng Zhong·· 12 小时前AI 评分31
ECHO：用响应危害性替代合规代理优化越狱攻击
ECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak Attack
AI 导读
ECHO 提出用 HarmSig（1.7B 回归器）输出的响应级连续危害性分数替代 token 级合规代理，结合五种词级扰动算子和带全局 top-m 记忆的 Keyword-Anchored Beam Search，在严格黑盒威胁模型下优化越狱攻击。
正文 · 原文
Abstract:Despite extensive safety alignment, large language models remain vulnerable to jailbreak attacks. Existing optimization-based attacks share a single objective: maximize a token-level proxy of victim compliance---such as the likelihood of an affirmative prefix---computed on the prompt rather than the decoded reply. This proxy cannot distinguish a cautious hedge from a fully actionable harmful answer, leaving the search blind to what the model actually says. We propose ECHO (Evaluation-Conditioned Harmfulness Optimization), which replaces the compliance proxy with response-level, continuous harmfulness scores from HarmSig, a 1.7B regressor grounded in actual harmful capability. ECHO couples HarmSig with five word-level perturbation operators and Keyword-Anchored Beam Search with global top-m memory, under a strict black-box threat model. Across five open-weight victims on AdvBench, ECHO achieves up to 0.898 StrongREJECT mean score and 89.23% HarmBench success. Our code is publicly available at this https URL.
| Subjects: | Cryptography and Security (cs.CR); Computation and Language (cs.CL) |
| Cite as: | arXiv:2610.23030 [cs.CR] |
| (or arXiv:2610.23030v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.23030 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Yuanwei Wu [view email]
[v1]
Fri, 16 Oct 2026 07:07:08 UTC (944 KB)
来源：arXiv cs.CL · arxiv.org