arXiv Releases CoFiBreak: A Novel Approach to Enhance Diversity and Efficiency in Multi-Turn Jailbreak Attacks
Summary:arXiv has recently introduced CoFiBreak, a novel method designed to enhance the diversity of multi-turn jailbreak attacks while maintaining high efficiency. CoFiBreak employs a coarse-to-fine reward mechanism to optimize Group Relative Policy Optimization (GRPO), achieving a balance between attack success rate and diversity. Experimental results demonstrate CoFiBreak's superior performance across multiple benchmarks, such as achieving a 98.8% attack success rate on AdvBench and 71.0% on the unse
1. Background and Motivation
In the field of AI safety, Automated Red Teaming trains an attacker LLM to elicit harmful responses from a victim LLM. However, existing methods often rely solely on attack success as the reward, leading to a collapse in the diversity of attack strategies, where attackers tend to use similar attack patterns. This lack of diversity biases AI safety evaluations toward repeatedly testing near-duplicate attack patterns rather than exploring the underlying harmful intents.
2. Core Mechanisms of CoFiBreak
CoFiBreak introduces a coarse-to-fine diversity reward mechanism to optimize Group Relative Policy Optimization (GRPO). Its core mechanisms include:
- Coarse Reward: By encouraging strategies underrepresented within each GRPO group, it broadens the range of strategies used by the attacker.
- Fine Reward: After removing harmful-intent information from prompt embeddings, it discourages the reuse of the same personas, framings, and output formats, broadening how those strategies are realized.
Additionally, diversity rewards are applied only to attacks that exceed an effectiveness threshold, ensuring that diversity is not gained through ineffective attacks. Since both rewards are computed only during training, CoFiBreak also retains inference efficiency.
3. Experimental Results and Performance
In experiments with Llama3.1-8B-Instruct as the victim, CoFiBreak discovered 1.6-2.0x as many distinct successful fine-grained strategies as the strongest baseline on HarmBench. On AdvBench, CoFiBreak achieved a 98.8% attack success rate (ASR@10) and the highest diversity score among all compared methods, which is 2.1x that of the strongest-attacking baseline.
Moreover, CoFiBreak's attacks transfer to unseen frontier LLMs, such as achieving a 71.0% ASR@10 on AdvBench with the unseen victim Claude-Opus-4.6.
4. Technical Trade-offs and Limitations
While CoFiBreak excels in enhancing attack diversity and success rate, it demands higher training data requirements, potentially increasing training costs. Additionally, the implementation complexity of the diversity reward mechanism necessitates careful tuning to avoid negatively impacting attack effectiveness.
5. Developer Recommendations
- Training Data Management: Developers are advised to use high-quality, diverse training data to fully leverage CoFiBreak's advantages.
- Parameter Tuning: When applying CoFiBreak, meticulous parameter tuning is required based on the specific task and target model to ensure the effectiveness and diversity of attack strategies.
- Safety Assessment: It is recommended to test CoFiBreak in controlled environments to evaluate its impact on AI system safety.
— END —Source: ArXiv NLP/LLM (cs.CL) (2026-11-02)
Tags: #CoFiBreak #AI Safety #Multi-Turn Jailbreak #Attack Diversity #arXiv
Editorial & Fact-Checking Note: This article is compiled from primary research, official release documentation, and source papers by the ZICQ Newsroom pipeline with automated entity verification and human editorial review. If you notice any technical inaccuracy, please submit a correction via our corrections policy or email our editorial desk directly.
Community Comments