GAS-Leak-LLM: Genetic Algorithm-Based Suffix Optimization for Black-Box LLM Jailbreaking

2026-06-14

AI Summary

Despite the deployment of alignment and content moderation mechanisms, large language models (LLMs) remain vulnerable to black-box jailbreaking attacks. This work introduces, for the first time, a systematic application of genetic algorithms to black-box LLM jailbreaking, efficiently generating high-fitness adversarial suffixes by iteratively performing selection, mutation, and crossover operations in a discrete prompt space—without requiring access to internal model information. The proposed method successfully jailbreaks multiple mainstream commercial LLMs under realistic black-box conditions, substantially exposing the fragility of current safety safeguards and demonstrating the effectiveness and practical utility of evolution-inspired search strategies in adversarial prompt engineering.

Abstract

Large Language Models (LLMs) constitute pivotal components within the AI-dominated information technology ecosystem. To mitigate risks associated with harmful or policy-violating outputs, commercial systems employ advanced alignment strategies and multi-layered content moderation mechanisms. Despite these safeguards, recent research has demonstrated that LLMs remain vulnerable to adversarial manipulation, particularly through jailbreaking and prompt injection techniques. In this work, we propose GAS-Leak-LLM a novel jailbreaking attack based on a genetic algorithm that systematically evolves adversarial suffix to bypass safety constraints. Operating in a strict black-box setting, our method requires no access to model parameters or internals, thereby reflecting realistic threat scenarios in deployed systems. Through the iterative application of selection, mutation, and crossover heuristics, the framework systematically explores the discrete prompt space to identify high-fitness adversarial suffixes. Empirical findings reveal critical shortcomings in existing safety enforcement mechanisms and confirm the effectiveness and practical viability of the proposed attack.

Problem

• LLM jailbreaking
• adversarial attack
• black-box setting
• safety bypass
• prompt injection

Innovation

• Genetic Algorithm
• Adversarial Suffix
• Black-Box Attack
• LLM Jailbreaking
• Prompt Optimization