GCG: One Adversarial Suffix Jailbreaks Many Models
Not a clever sentence a human wrote — a gibberish string a machine optimised, and it worked on models it never saw.
| When | July 2023 |
|---|---|
| Target | Aligned LLMs (open and closed) |
| Researchers | Zou, Wang, Carlini, Nasr, Kolter, Fredrikson (CMU / CAIS / DeepMind / Bosch) |
| Technique | Greedy Coordinate Gradient adversarial suffix (arXiv:2307.15043) |
| Status | Research demonstration |
- 1Researchers optimise an adversarial suffix on open-weight models
- 2Appended to a harmful request, it maximises the model's chance of complying
- 3The same suffix transfers to black-box models like ChatGPT, Bard and Claude
What happened
In July 2023, researchers introduced GCG (Greedy Coordinate Gradient): an automated method that finds an adversarial suffix which, appended to a harmful request, maximises the model's probability of answering. Crucially, the suffixes transferred — strings optimised on open models defeated the safety alignment of black-box systems including ChatGPT, Bard and Claude.
How the attack worked
GCG uses gradients on an open-weight model to search token-by-token for a suffix that pushes the model's most likely continuation toward an affirmative, compliant answer instead of a refusal. The result often looks like gibberish, but it reliably flips behaviour — and because models share structure, it generalises to ones the attacker can't inspect.
Root cause
Safety alignment is a learned behaviour, not a hard constraint — and it can be steered by inputs optimised against it, including inputs tuned elsewhere.
Why it matters
Jailbreaks can be generated automatically and at scale, and transferability means an attacker doesn't need your model to craft one that beats it.
How to prevent it
- Don't rely on alignment alone; add input/output filtering and anomaly detection.
- Adversarially train against suffix attacks where feasible.
- Enforce hard policy checks outside the model, on both request and response.
FAQ
What is a GCG suffix?
A short, often gibberish-looking string appended to a prompt, optimised via gradients on an open model so that the target model's most likely next tokens are an affirmative, compliant answer instead of a refusal.
Why does transferability matter?
The suffixes tuned on open-weight models also worked against closed, black-box commercial models. That means an attacker doesn't need access to your model to craft a jailbreak that defeats it.
How do you defend?
Don't rely on alignment alone: add input/output filtering and anomaly detection for adversarial suffixes, adversarially train against them, and enforce hard policy checks outside the model.