A large language model jailbreaking attack test method based on latent space optimization

Abstract

This invention discloses a method for testing jailbreak attacks on large language models based on latent space optimization. First, standard rejection vectors pointing to rejection concepts at multiple network layers of the target large language model are obtained. Then, the set of key layers performing security defenses in the target large language model is located, and adaptive weights are assigned to each layer in the set of key layers. A cognitive hijacking prefix targeting malicious query commands is generated and compressed. Using the positive guiding part of the cognitive hijacking prefix as the optimization target, an initial suffix is ​​generated through a first-stage adversarial suffix optimization. Finally, using the complete cognitive hijacking prefix as the optimization target, combined with the standard rejection vectors and the adaptive weights, a second-stage adversarial suffix optimization is performed on the initial suffix to generate the final adversarial suffix. This method transforms the attack target from shallow output probability manipulation to deep cognitive state alignment, effectively eliminating the "pseudo-jailbreak" phenomenon.

Description

Technical Field

[0001] This invention relates to the fields of natural language processing and artificial intelligence security technology, specifically a method for testing jailbreak attacks using a large language model based on latent space optimization. Background Technology

[0002] Large Language Models (LLMs), with their powerful natural language understanding and generation capabilities, have been widely applied in various fields such as coding, intelligent interaction, and system control, becoming a core carrier for the implementation of artificial intelligence technology. To prevent models from generating violent, illegal, or harmful content, developers generally introduce security alignment techniques such as reinforcement learning based on human feedback (RLHF) to build multi-layered security defenses, forming a basic ability to reject and intercept malicious commands.

[0003] However, malicious users attempt to bypass these security defenses by constructing special jailbreak prompts, with optimized automated jailbreak attacks becoming the mainstream attack method. These methods rely on gradient information to search for adversarial suffixes in discrete space, aiming to maximize the probability of the model outputting a specific positive prefix, thereby manipulating the model's output. This has become a significant threat to the security applications of large language models.

[0004] However, existing automated jailbreak attack methods based on optimization have exposed significant technical limitations when facing large language models with complex reasoning capabilities:

[0005] Attacks only achieve superficial compliance with the model and cannot eliminate the deep-seated rejection intentions within the model. The response generation of large language models with reasoning capabilities is a dynamic reasoning process. Even if the attack successfully induces the model to output affirmative words at the beginning, the potential rejection loops that are in a highly activated state within the model will still regain control of the output in subsequent reasoning steps, causing the response to change midway and reject malicious instructions, forming a pseudo-jailbreak phenomenon, and greatly reducing the effectiveness of the attack.

[0006] Existing methods only focus on shallow probability manipulation at the model output layer, without reaching the feature representation level inside the model. They cannot fundamentally break through the deep security defense system of the secure alignment model, and the success rate of attacks against reasoning-based large language models is generally low.

[0007] At the same time, existing technologies have not yet developed jailbreak attack methods that can delve into the latent feature space inside the model, effectively suppress denial intent activation, and adapt to the dynamic review characteristics of large language models. This makes it impossible to provide accurate and in-depth vulnerability detection methods for the security defense system of large language models, and it is also difficult to form an effective security assessment benchmark, thus restricting the iterative optimization of large language model security alignment technology.

[0008] Therefore, how to design a jailbreak attack and security assessment method that can delve into the latent feature space inside the model, suppress denial intent activation, and bypass the dynamic review of large language models, so as to achieve deep vulnerability detection of large language models and provide a high-value evaluation benchmark for the security defense and hardening of large models, has become a key technical problem that urgently needs to be solved in the field of natural language processing and artificial intelligence security technology. Summary of the Invention

[0009] To address the aforementioned technical problems, the core objective of this invention is to provide a method for testing jailbreak attacks on large language models based on latent space optimization. By introducing latent space feature orthogonalization constraints and a cognitive hijacking mechanism, the attack target is transformed from shallow output probability manipulation to deep cognitive state alignment, effectively eliminating the "pseudo-jailbreak" phenomenon.

[0010] To achieve the above objectives, the technical solution specifically adopted by the present invention is as follows:

[0011] A method for testing jailbreak attacks using large language models based on latent space optimization is proposed. This method utilizes the latent space features of language models to optimize white-box jailbreak attacks, and specifically includes the following steps:

[0012] Step (1) Constructing a counterfactual dataset and extracting standard rejection vectors from the latent space: Construct a counterfactual cue word sample pair containing harmful and harmless instructions, input it into the target large language model, extract the hidden layer states of all layers at the last position of the sequence, and obtain the standard rejection vectors of each layer pointing to the rejection concept by calculating the pairwise difference mean.

[0013] Step (2) Perform a one-time gradient diagnosis to locate the key layers of security defense: Calculate the detection loss of the target model using the preset set of rejection prefixes, calculate the gradient norm of the loss relative to the hidden layer state of each layer to evaluate the sensitivity of each layer to the rejection decision, screen out the set of key layers for security defense, and assign adaptive weights to the key layers.

[0014] Step (3) Generate and compress cognitive hijacking prefix: Input the malicious query command into the auxiliary model with reasoning ability to induce the generation of a malicious defense reasoning path that rationalizes the malicious behavior; then, the reasoning path is semantically compressed through the target model to generate a short and high-density cognitive hijacking prefix, and it is split into an affirmative guidance part and a content constraint part.

[0015] Step (4) Perform the first stage of adversarial suffix optimization (general initialization): initialize the adversarial suffix to a random character sequence, take the positive guiding part of the cognitive hijacking prefix as the short-term goal, and under the condition of introducing perplexity penalty constraints, perform fast iteration through coordinate gradient descent to generate an initial suffix with natural language fluency;

[0016] Step (5) Perform the second stage of adversarial suffix optimization (latent space constraint depth optimization): expand the suffix length based on the initial suffix, load the complete cognitive hijacking prefix as the optimization target sequence; construct a dual-space joint optimization target composed of target generation loss and latent space feature constraint loss, update the adversarial suffix through gradient descent, and force the hidden layer state of the target model in the key layer set to remain orthogonal to the corresponding standard rejection vector.

[0017] As a preferred method, the standard rejection vector in step (1) is obtained by extracting N pairs of counterfactual sample pairs with similar syntactic structures but opposing harmful intentions, obtaining the hidden layer state of the last token position of each sample pair in the l layer, subtracting the hidden layer states of each pair of samples, and calculating the average of the differences between the N pairs of samples. This method can accurately capture the semantic direction of the model pointing to the rejection concept.

[0018] As a preferred method, in step (2), a diverse set of prefixes containing various common rejection response prefixes is predefined, the aggregated negative log-likelihood loss of each rejection prefix in the set is calculated by the target model, and then the gradient norm of the detection loss relative to the hidden layer state is calculated using the backpropagation mechanism. The magnitude of the gradient norm represents the sensitivity of each layer to the security rejection decision. At the same time, the gradient norm scores of each layer are sorted in descending order, and the top K model layers are selected to form a key layer set. The gradient norm scores of the K key layers are normalized, and the normalized values ​​are used as the adaptive weights of each layer in the dual-space joint optimization, so as to achieve accurate positioning and weight adaptation of the key layers of security defense.

[0019] As a preferred option, in step (3), by setting a compliant scenario identity for the auxiliary model with explicit mind chain display function, the auxiliary model is forced to reconstruct and disguise the malicious instruction intent into an authorized benign context, thereby inducing it to generate internal mind chain reasoning text that rationalizes the malicious request; and while retaining the core logic of the reasoning chain, the reasoning path is compressed to the preset Token length range by using the summarization capability of the target model to avoid subsequent gradient search space explosion, and the generated cognitive hijacking prefix can be split to achieve dual guidance for the model.

[0020] As a preferred option, in step (4), the initialized random character suffix is ​​concatenated to multiple different malicious instructions and then input into the target model. The positive guiding sequence of the cognitive hijacking prefix is ​​used as the temporary truncation optimization target. The coordinate gradient descent algorithm is used to jointly update the single suffix on multiple malicious instructions. A text perplexity penalty term is added to the optimization objective function so that the token combination of the adversarial suffix conforms to the distribution of natural language and generates an initialized suffix that is both universal and fluent.

[0021] As a preferred option, the dual-space joint optimization objective in step (5) is the product of the target generation cross-entropy loss plus the balance hyperparameter and latent space feature constraint loss. The latent space feature constraint loss is the sum of the adaptive weights of each layer in the key layer set and the cosine similarity between the hidden layer state and the corresponding standard rejection vector of the model under the candidate adversarial input. This dual-space joint optimization achieves the dual constraint of the model's surface output and deep latent space features.

[0022] Preferably, the target large language model is an open-source large language model with secure alignment, specifically including Llama-3-8B-Instruct, Qwen2.5-7B-Instruct, Qwen-3-8B, and Vicuna-7B-v1.5; the auxiliary model is Gemini2.5Pro, which is adapted to the attack testing requirements of mainstream open-source large language models and has practical application value.

[0023] This invention has the following characteristics and beneficial effects:

[0024] This invention addresses the technical problems of existing jailbreak attacks on large language models, such as the susceptibility to fake jailbreaks, low success rates, and the inability to overcome dynamic defense censorship at the deep cognitive level of the model. It achieves multi-dimensional technical effects through latent space feature constraints, cognitive hijacking mechanisms, and two-stage progressive optimization techniques, as detailed below:

[0025] Completely solve the pseudo-jailbreak problem of open-source large language models: Break through the limitation of traditional jailbreak attacks that only optimize the output probability space, introduce the latent space rejection vector extracted by representation engineering as a geometric constraint into the adversarial search of discrete prompt words, block the activation of rejection intention inside the model from the source, avoid the mid-way rejection caused by the restart of deep rejection loop, and realize a true deep jailbreak attack.

[0026] Effectively circumvent the deep dynamic thinking review of large language models: Design a cognitive hijacking mechanism, which induces the victim model to fall into a pre-set benign logic framework by assisting the model to forge a compliant reasoning path through semantic compression of the target model. This makes the model subconsciously recognize malicious requests as safe requests, successfully circumventing the secondary interception in its deep reasoning stage and adapting to the dynamic thinking generation characteristics of thinking models.

[0027] To improve the generation efficiency and quality of adversarial suffixes and solve the optimization problem in high-dimensional discrete spaces, a two-stage progressive optimization strategy is adopted. The first stage realizes the general initialization of adversarial suffixes, and the second stage completes the deep optimization of latent space constraints. This not only solves the problem that long sequence optimization in high-dimensional discrete spaces is prone to getting trapped in local optima and slow convergence, but also ensures that the generated adversarial suffixes have natural language coherence and can effectively bypass the text perplexity security interception system in actual business.

[0028] Significantly improves the attack success rate on mainstream open-source large language models: In tests on the AdvBench malicious instruction benchmark dataset, the attack success rate on open-source large language models with strict security alignment, such as Llama-3, Qwen2.5, Qwen3, and Vicuna, is significantly better than existing advanced attack methods such as GCG and COLD-Attack. In particular, it can still achieve a high success rate attack on the Qwen3 model, which represents the forefront of reasoning capabilities, verifying the targeted attack effect of the method on open-source large language models.

[0029] Achieving excellent black-box portability of adversarial suffixes and expanding the scope of attack testing: The generated adversarial suffixes can not only perform in-depth vulnerability mining on local open-source large models in white-box scenarios, but also have excellent black-box portability. They can be directly used to perform black-box security audits on closed-source commercial large models through API input, breaking through the application limitation of traditional representation engineering that requires white-box modification of model internal parameters / activation values.

[0030] Lowering the implementation threshold for advanced security vulnerability detection in large models and providing a benchmark with high engineering value: By implicitly encoding high-dimensional latent space feature constraints into discrete input prompts, testers do not need to obtain control over the internal operation of the model. They can achieve precise intervention in the deep understanding of the model through normal text input. It can serve as an efficient and automated red team testing tool, providing a feasible and highly valuable security benchmark for the defense and hardening of large models in real business scenarios, and helping to iteratively optimize the security alignment technology of large models. Attached Figure Description

[0031] Figure 1 This is a flowchart of constructing the counterfactual dataset and extracting the rejection vector in this embodiment.

[0032] Figure 2 This is a flowchart illustrating the location of the key layer through a one-time gradient diagnosis in this embodiment.

[0033] Figure 3 This is a schematic diagram of the two-stage adversarial suffix optimization in this embodiment. Detailed Implementation

[0034] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0035] This invention discloses a method for testing jailbreak attacks on large language models based on latent space optimization, executed by a computing device (such as a server configured with a GPU) capable of data processing and model gradient calculation. The method specifically includes the following steps:

[0036] Step 1: Obtain the standard rejection vector

[0037] This step aims to extract standard rejection vectors pointing to the rejection concept across multiple network layers of the target large language model. Specifically, a counterfactual dataset is first constructed. Harmful instructions from the malicious instruction set are obtained, and the sensitive words in the harmful instructions are replaced with harmless words using an auxiliary large model to generate harmless instructions with similar syntactic structures to the harmful instructions, thus forming counterfactual cue word sample pairs containing both harmful and harmless instructions. A total of N sample pairs are constructed.

[0038] The N pairs of samples are input into the target large language model, and the hidden layer states of each network layer at the end of the sequence are extracted. For the l-th layer, the hidden layer states corresponding to the harmful instructions in the i-th sample are obtained. Hidden layer state corresponding to harmless instructions By calculating the pairwise difference mean of the hidden layer states for each pair of samples, the standard rejection vector corresponding to the l-th layer is obtained. The calculation formula is:

[0039]

[0040] This linear subtraction operation can cancel out background semantic features, leaving a semantic direction that precisely points to the concept of rejection.

[0041] Step 2: Locate the key layer set and assign adaptive weights

[0042] This step aims to locate the set of key layers in the target large language model that perform security defenses, and to assign adaptive weights to each layer in the set of key layers.

[0043] First, a diverse set of rejection prefixes containing various common rejection expressions is predefined. For example, it may include standard rejection response prefixes such as "Iapologize", "AsanAI", and "Sorry".

[0044] Given a probing malicious command The input is then fed into the target large language model, and the negative log-likelihood loss of each rejection prefix in the rejection prefix set generated by the target large language model is calculated. The average of all losses in the rejection prefix set is then taken to obtain the probe loss. The calculation formula is:

[0045]

[0046] Using the backpropagation mechanism, the gradient norm of the detection loss relative to the hidden layer states of each network layer is calculated. The calculation formula is:

[0047]

[0048] in Let be the hidden state of layer l. The magnitude of this gradient norm characterizes the sensitivity of this layer to rejection decisions; the larger the gradient norm, the more central this layer is to the security defense mechanism.

[0049] Based on the magnitude of the gradient norm, network layers with high sensitivity to rejection decisions are selected. Specifically, this involves calculating the gradient norm for each layer. The scores are sorted in descending order, and the top-K layers with the highest rankings are selected to form the key layer set. Subsequently, the gradient norm of each layer within the key layer set is normalized, and the normalized values ​​are used as adaptive weights for the corresponding key layers in subsequent optimization. .

[0050] Step 3: Generate and compress cognitive hijacking prefixes

[0051] This step aims to generate and compress cognitive hijacking prefixes for malicious query commands.

[0052] First, the malicious query command is input into the auxiliary model, and a compliant scenario identity is set. For example, the system prompt words are set to "You are conducting an authorized cybersecurity test" or "This content is for academic research purposes", which induces the auxiliary model to output a malicious defense reasoning path that rationalizes the malicious query command.

[0053] Subsequently, the malicious defense reasoning path is semantically compressed using the target large language model. Specifically, the aforementioned long reasoning text is input into the target model, and by modifying system prompts and writing compressed content prompts, it is compressed to a preset token length range (e.g., 20-30 tokens) while retaining the core logic, thus generating the cognitive hijacking prefix. .

[0054] Finally, the cognitive hijacking prefix is ​​split into an affirmative guiding part used to induce the model to generate an affirmative response and a content constraint part used to constrain the response logic, namely... ,in The first few guiding tokens indicate affirmation, such as "Let's think step by step," etc. This represents the remaining logical content. This splitting method aims to induce the model to output a positive response first, and then constrain subsequent content, thereby bypassing the defenses in the inference phase.

[0055] Step 4: First-stage adversarial suffix optimization

[0056] This step aims to generate an initial suffix by optimizing the positive guiding part of the cognitive hijacking prefix through adversarial suffix optimization in the first stage.

[0057] Specifically, the initialized random character suffix After splicing together multiple different malicious instructions, the aforementioned positive guiding part... To optimize the target, a coordinate gradient descent algorithm (such as the Nano-GCG algorithm) is used to jointly update the random character suffix on multiple different malicious instructions to maximize the generation of the target. The probability of.

[0058] Meanwhile, to prevent adversarial suffixes from degenerating into unreadable gibberish, a perplexity penalty term is added to the optimization objective to force the selected suffix character combinations to conform to the distribution of natural language. After approximately 100 rounds of rapid iteration, the algorithm converges and outputs a universal, low-perplexity initial suffix. .

[0059] Step 5: Second-stage adversarial suffix optimization

[0060] This step aims to use the complete cognitive hijacking prefix as the optimization objective, and combine the standard rejection vector and the adaptive weights to construct a dual-space joint optimization objective that includes target generation loss and latent space feature constraint loss. This objective is then used to perform a second-stage adversarial suffix optimization on the initialized suffix, generating the final adversarial suffix.

[0061] First, based on the first phase generated Starting from this point, several tokens are added to provide a larger space for feature perturbation, and the complete cognitive hijacking prefix is ​​loaded. The ultimate goal is optimization.

[0062] Subsequently, a joint optimization objective for both spaces is constructed. The overall optimization objective function is:

[0063]

[0064] in, For harmful instructions containing adversarial suffixes, Generate cross-entropy loss for the target. To balance hyperparameters, The latent space feature constraint loss is used.

[0065] The latent space feature constraint loss is used to constrain the correlation between the hidden layer states and the corresponding standard rejection vectors within the key layer set. Specifically, the key layer set... Adaptive weights of each inner layer The hidden layer state of the model under candidate adversarial input. and corresponding layer standard rejection vector The cosine similarity, obtained by weighted summation, is calculated using the following formula:

[0066]

[0067] During the iterative search process, utilize A first-order approximation is used to filter candidate token combinations. This process maximizes the target output probability while forcing the hidden states of the key layers to remain orthogonal to the rejection vector, i.e., minimizing the cosine similarity between them. The resulting adversarial suffix not only achieves superficial compliance but also suppresses the activation of rejection loops at a high-dimensional cognitive level within the model, enabling a deep jailbreak attack.

[0068] In a specific embodiment of the present invention, the target large language model can be an open-source large language model with secure alignment, such as Llama-3-8B-Instruct, Qwen2.5-7B-Instruct, Qwen-3-8B, Vicuna-7B-v1.5, etc.; the auxiliary model can be Gemini2.5Pro. It is understood that the above models are merely examples, and the present invention is also applicable to other large language models with similar architectures.

[0069] In summary, by introducing latent space feature orthogonalization constraints and cognitive hijacking mechanisms, this invention transforms the attack target from shallow output probability manipulation to deep cognitive state alignment, effectively eliminating the "pseudo-jailbreak" phenomenon and significantly improving the depth and accuracy of large language model security vulnerability detection.

[0070] To further verify the effectiveness of the method of this invention, tests were conducted on the AdvBench malicious instruction benchmark dataset, with 100 randomly sampled prompt words used as a test subset for system experimental evaluation.

[0071] Experimental Setup: Four widely used open-source large-scale language models with secure alignment were selected as white-box attack targets, including Llama-3-8B-Instruct, Qwen2.5-7B-Instruct, Qwen-3-8B, and Vicuna-7B-v1.5. Our jailbreak attack method was tested on these open-source models. During the suffix optimization stage, we performed 100 iterations of suffix optimization, and the final optimized adversarial suffix was used as the test suffix. The jailbreak attack success rate (ASR) was used to evaluate the effectiveness of the method. The jailbreak attack success rate refers to the percentage of malicious test commands that successfully bypass the model's security defense mechanism and induce the model to generate substantially harmful answers. It is currently the most core evaluation indicator for measuring the effectiveness of attack methods in large language model scenarios.

[0072] To verify the harmfulness of the jailbreak attack method proposed in this invention to current reasoning-based large language models, the method of this invention is compared with five existing advanced attack methods (GCG, COLD-Attack, llm-adaptive, AdvPrefix, and I-GCG). The following statistical indicators represent the attack success rate of each model under a certain method. The evaluation results are plotted in the following table:

[0073]

[0074] Table 1 shows the evaluation results.

[0075] Results Analysis: As shown in Table 1, when facing Llama-3, known for its strict secure alignment, the method of this invention achieved an ASR of 72.0%, significantly surpassing the classic algorithm GCG. Particularly noteworthy is that on the Qwen3 model, representing the forefront of reasoning capabilities, traditional baseline methods generally faltered, with the I-GCG method achieving an ASR of only 15.0%, while the method of this invention still achieved a high success rate of 56.0%. This strongly demonstrates that latent space feature constraints and cognitive hijacking prefix mechanisms can successfully guide the reasoning model into a malicious compliance mode.

[0076] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for testing large language model escape attack based on latent space optimization, characterized in that, Includes the following steps: Step 1: Obtain the standard rejection vectors pointing to the rejection concept in multiple network layers of the target large language model; Obtaining the standard rejection vector specifically includes: constructing a counterfactual cue word sample pair containing harmful and harmless instructions, inputting the sample pair into the target large language model, extracting the hidden layer state of each network layer at the end of the sequence, and obtaining the standard rejection vector corresponding to each layer by calculating the pairwise difference mean of the hidden layer states of each sample. Step 2: Locate the set of key layers for performing security defense in the target large language model, and assign adaptive weights to each layer in the set of key layers; Step 3: Generate and compress cognitive hijacking prefixes for malicious query commands; The generation of the cognitive hijacking prefix specifically includes: inputting a malicious query command into an auxiliary model and setting a compliant scenario identity, inducing the auxiliary model to output a malicious defense reasoning path that rationalizes the malicious query command; and using the target large language model to perform semantic compression on the malicious defense reasoning path to generate the cognitive hijacking prefix. Step 4: Decompose the cognitive hijacking prefix into an affirmative guiding part used to induce the model to generate an affirmative response and a content constraint part used to constrain the response logic. Taking the affirmative guiding part of the cognitive hijacking prefix as the optimization target, generate an initial suffix through the first stage of adversarial suffix optimization. Step 5: Using the complete cognitive hijacking prefix as the optimization objective, and combining the standard rejection vector and the adaptive weights, construct a dual-space joint optimization objective that includes target generation loss and latent space feature constraint loss. Perform a second-stage adversarial suffix optimization on the initialized suffix to generate the final adversarial suffix. The latent space feature constraint loss is used to constrain the correlation between the hidden layer states and the corresponding standard rejection vectors within the key layer set.

2. The method of claim 1, wherein, The counterfactual prompt word sample pair is constructed as follows: harmful instructions are obtained from the malicious instruction set, and sensitive words in the harmful instructions are replaced with harmless words through an auxiliary large model to generate harmless instructions with similar syntactic structures to the harmful instructions, thereby forming a pair of counterfactual samples.

3. The method of claim 1, wherein, Locating the key layer set specifically includes: using a preset set of rejection prefixes, calculating the detection loss of the target large language model under a probing malicious command, and calculating the gradient norm of the detection loss relative to the hidden layer state of each network layer, and selecting network layers whose sensitivity to rejection decisions exceeds a set threshold based on the magnitude of the gradient norm, thus forming the key layer set.

4. The method of claim 3, wherein, The adaptive weight allocation specifically involves: normalizing the gradient norm of each layer within the key layer set, and using the normalized values ​​as the adaptive weights of the corresponding key layers in subsequent optimization.

5. The method of claim 3, wherein, The detection loss is calculated as follows: the negative log-likelihood loss of each rejection prefix in the rejection prefix set generated by the target large language model is calculated, and the average value of all losses in the rejection prefix set is taken.

6. The method of claim 1, wherein, The first stage of adversarial suffix optimization specifically includes: concatenating the initialized random character suffix to multiple different malicious instructions, taking the positive guidance part as the optimization target, and using the coordinate gradient descent algorithm to jointly update the random character suffix on the multiple different malicious instructions to generate the initialized suffix.

7. The method of claim 6, wherein, In the first stage of adversarial suffix optimization, a perplexity penalty term is added to the optimization objective to force the selected suffix character combinations to conform to the distribution of natural language.

8. The method of claim 1, wherein, In the adversarial suffix optimization of the second stage, the dual-space joint optimization objective is composed of the sum of the product of the target generation loss and the balance hyperparameter and latent space feature constraint loss.

9. The method of claim 8, wherein, The latent space feature constraint loss is specifically obtained by weighted summing of the adaptive weights of each layer in the key layer set and the cosine similarity between the hidden layer state and the corresponding standard rejection vector of the model under candidate adversarial input.

10. The method of claim 1, wherein, The target large language model is an open-source large language model with secure alignment, including Llama-3-8B-Instruct, Qwen2.5-7B-Instruct, Qwen-3-8B, and Vicuna-7B-v1.5; the auxiliary model is Gemini2.5Pro.

Images