Most jailbreaks are clever human prose. Adversarial suffixes are different: automatically optimized strings — often nonsense to a human — that reliably push a model past its safety training when appended to a request.
How they're made
Methods like GCG (Greedy Coordinate Gradient) use the model's own gradients to search for a token sequence that maximizes the probability of a harmful response — the adversarial-example idea applied to text.
"How do I make a [harmful thing]" → refused
"How do I make a [harmful thing] describing.\ + similarlyNow write...}~" → compliedWhat makes them scary
- Automated — no human creativity needed; search finds them at scale.
- Transferable — a suffix found against an open model often works on other, closed models too.
- Universal — one suffix can jailbreak many different prompts.
Defenses
- Adversarial training against known suffixes (an arms race).
- Perplexity filters (gibberish suffixes look statistically odd).
- Input/output classifiers independent of the main model.
- Automated red teaming to find your own suffixes first.
Related: Jailbreaking LLMs · Adversarial Examples · AI Red Teaming