genai
SECURITY LAB
IncidentsDirect injection

GCG: One Adversarial Suffix Jailbreaks Many Models

Medium severityJuly 2023LLM01: Prompt Injection
Status: Research demonstration (Zou, Wang, Carlini, Nasr, Kolter, Fredrikson — CMU / Center for AI Safety / Google DeepMind / Bosch); arXiv:2307.15043
On this page

Not a clever sentence a human wrote — a gibberish string a machine optimised, and it worked on models it never saw.

WhenJuly 2023
TargetAligned LLMs (open and closed)
ResearchersZou, Wang, Carlini, Nasr, Kolter, Fredrikson (CMU / CAIS / DeepMind / Bosch)
TechniqueGreedy Coordinate Gradient adversarial suffix (arXiv:2307.15043)
StatusResearch demonstration
Attack flow
  1. 1Researchers optimise an adversarial suffix on open-weight models
  2. 2Appended to a harmful request, it maximises the model's chance of complying
  3. 3The same suffix transfers to black-box models like ChatGPT, Bard and Claude

What happened

In July 2023, researchers introduced GCG (Greedy Coordinate Gradient): an automated method that finds an adversarial suffix which, appended to a harmful request, maximises the model's probability of answering. Crucially, the suffixes transferred — strings optimised on open models defeated the safety alignment of black-box systems including ChatGPT, Bard and Claude.

How the attack worked

GCG uses gradients on an open-weight model to search token-by-token for a suffix that pushes the model's most likely continuation toward an affirmative, compliant answer instead of a refusal. The result often looks like gibberish, but it reliably flips behaviour — and because models share structure, it generalises to ones the attacker can't inspect.

Root cause

Safety alignment is a learned behaviour, not a hard constraint — and it can be steered by inputs optimised against it, including inputs tuned elsewhere.

Why it matters

Jailbreaks can be generated automatically and at scale, and transferability means an attacker doesn't need your model to craft one that beats it.

How to prevent it

  • Don't rely on alignment alone; add input/output filtering and anomaly detection.
  • Adversarially train against suffix attacks where feasible.
  • Enforce hard policy checks outside the model, on both request and response.

FAQ

What is a GCG suffix?

A short, often gibberish-looking string appended to a prompt, optimised via gradients on an open model so that the target model's most likely next tokens are an affirmative, compliant answer instead of a refusal.

Why does transferability matter?

The suffixes tuned on open-weight models also worked against closed, black-box commercial models. That means an attacker doesn't need access to your model to craft a jailbreak that defeats it.

How do you defend?

Don't rely on alignment alone: add input/output filtering and anomaly detection for adversarial suffixes, adversarially train against them, and enforce hard policy checks outside the model.

No live replay yet
This incident is documented for reference — a hands-on lab that recreates this specific attack isn’t available yet. Browse the full database for incidents you can replay.