DUALBREACH: Efficient Dual-Jailbreaking via Target-Driven Initialization and Multi-Target Optimization

Recent research has focused on exploring the vulnerabilities of Large Language Models (LLMs), aiming to elicit harmful and/or sensitive content from LLMs. However, due to the insufficient research on dual-jailbreaking-attacks targeting both LLMs and Guardrails, the effectiveness of existing attacks is limited when attempting to bypass safety-aligned LLMs shielded by guardrails. Therefore, in this paper, we propose DUALBREACH, a target-driven framework for dual-jailbreaking. DUALBREACH employs a Target-driven Initialization (TDI) strategy to dynamically construct initial prompts, combined with a Multi-Target Optimization (MTO) method that utilizes approximate gradients to jointly adapt the prompts across guardrails and LLMs, which can simultaneously save the number of queries and achieve a high dual-jailbreaking success rate. For black-box guardrails, DUALBREACH either employs a powerful open-sourced guardrail or imitates the target black-box guardrail by training a proxy model, to incorporate guardrails into the MTO process. We demonstrate the effectiveness of DUALBREACH in dualjailbreaking scenarios through extensive evaluation on several widely-used datasets. Experimental results indicate that DU-ALBREACH outperforms state-of-the-art methods with fewer queries, achieving significantly higher success rates across all settings. More specifically, DUALBREACH achieves an average dualjailbreaking success rate of 93.67% against GPT-4 with Llama-Guard-3 protection, whereas the best success rate achieved by other methods is 88.33%. Moreover, DUALBREACH only uses an average of 1.77 queries per successful dual-jailbreak, outperforming other state-of-the-art methods. For defense, we propose an XGBoost-based ensemble defensive mechanism named EGUARD, which integrates the strengths of multiple guardrails, demonstrating superior performance compared with Llama-Guard-3. Disclaimer: This paper studies jailbreak attacks against prevailing guardrails and LLMs. The proposed attack and defense have been responsibly reported to relevant stakeholders by email (e.g., NVIDIA, Guardrails AI, etc.