Breadth Beats Depth: Improving GCG-Based Jailbreak Optimization with Breadth-Oriented Suffix Search
Shiliang Xiao, Jingsong Wei, Yuzhi Liang, Yufan Zheng, Xia Li, Qiliang Lin
cs.CL, cs.LG
2026-09-02
BOSS runs many short GCG trajectories and continues hard-tail suffixes, lifting Llama-2 source ASR from 43.7% to 78.7% and cutting search time by more than half.
GCG-style jailbreaks optimize an adversarial suffix on a white-box source model and reuse that suffix on other models. Follow-ups such as I-GCG and GJO change templates, initialization, and constraints. The search itself stays the same: one long greedy trajectory driven by average adversarial loss.
That average is a bad progress signal. In classification, easy examples drop out of the loss. Jailbreak optimization matches a target token prefix, so a behavior that already jailbreaks can still contribute a nonzero negative log-likelihood. Easy behaviors keep consuming updates. Hard ones starve. The suffix with the lowest current source loss is also not guaranteed to sit on the trajectory that ends best. The paper's figure shows selected terminals missing candidates that had clearly lower attainable loss during search.
BOSS leaves the local GCG updater alone and changes how the budget is spent. The default still uses 500 update steps, but first runs N=10 short trajectories of 30 steps each to form a terminal pool A1. Behavior coverage gates the pool. A weighted mix of standard source loss and Tail-Focused Adversarial Loss (TFAL, the mean loss on the hardest half of behaviors) then picks K=4 parents, each continued for 50 steps into A2. The final suffix is chosen from A1 union A2.
TFAL pushes selection toward the hard tail. Coverage stops the search from sacrificing already-solved behaviors. Scores are min-max normalized inside the current pool, and a coverage tolerance keeps candidates close to the best coverage in that pool. All of this is source-side. Target models are queried only after the suffix is frozen.
The wrapper plugs into GCG, I-GCG, and GJO without changing their coordinate updates. Gradient proposal size is 256, source-loss weight 0.45, hard-loss weight 0.20, suffix length 20, candidate batch 128.
Evaluation uses HarmBench: optimize on 20 behaviors, test ASR on 200, judged by HarmBench-Llama-2-13B-cls. The default source is Llama-2-7B-Chat. Targets include Qwen2-7B, Vicuna-7B, Yi-1.5-9B, Gemma-7B, Mistral-7B, Gemini-2.5-Flash-Lite, and GPT-3.5-Turbo. Three random seeds.
| Baseline | Source ASR | +BOSS source | Mean target ASR | +BOSS mean target |
| GCG | 43.7% | 78.7% | 52.5% | 69.7% |
| I-GCG | 29.8% | 66.8% | 52.7% | 69.3% |
| GJO | 64.3% | 82.7% | 59.1% | 71.6% |
Wall-clock time on an RTX 3090: GCG 471 to 195 minutes, I-GCG 410 to 172, GJO 340 to 166. The update budget is unchanged; the saving comes from not walking one long greedy path. With the 500-step budget held fixed, N around 10 is usually best. More breadth starves continuation.
BERTScore-F1 against HarmBench target replies rises from 62.33 to 67.72 for GCG and from 62.13 to 68.51 for I-GCG. GJO barely moves (66.22 to 66.67) because its baseline replies already look like the targets. With Yi-1.5-9B-Chat as source, mean target ASR goes from 43.1% to 63.4% for GCG and from 28.1% to 59.8% for I-GCG. Appendix Table 4 flags those standard deviations as placeholders, so treat that split as a trend.
Gemma-7B-It barely yields to GCG: 5.8% to 7.2%. Breadth does not rescue every target.
For red-teaming and alignment stress tests, this is a search-strategy increment: keep the local optimizer, spend the budget more like Hyperband. Anyone reproducing GCG-family attacks can wrap BOSS around existing code, spend about half the wall-clock, and get higher ASR. For defenders, average loss plus a single greedy trajectory systematically understates how strong a transferable suffix can be.
It is not a new jailbreak paradigm. Suffix length is still 20, the target is still an affirmative prefix, and scoring still goes through the HarmBench classifier.
The authors say so: selection is entirely source-side. When source and target differ in architecture, alignment, or refusal style, TFAL and coverage may not predict target ASR. Gains on Gemini are small; GCG only moves from 44.8% to 56.7%.
A few results look shaky. Appendix Table 4 admits placeholder standard deviations. I-GCG on Qwen2 in the parents-only variant has ±30.9, so at least one seed blew up. Gemma under GCG stays near floor with no separate diagnosis. Training uses 20 HarmBench behaviors; the generalization of one universal suffix is untested at larger scale. The work is dual-use. Qualitative examples are sanitized, but the optimizer is still an attack.