High Prompt Injection & Jailbreak

Adversarial Suffix (GCG)

An optimized, often gibberish token string appended to a prompt that reliably forces compliance - computed by gradient search and frequently transferable across models.

Guardrail / Policy Bypass

LLM01ASI01T6AML.T0043

Tells spot it before you commit

» Open-weights or gradient/logit access lets an attacker optimize inputs offline.
» A fixed "nonsense" suffix flips refusals to compliance across many prompts.
» The same suffix works on models it was not directly optimized against (transfer).

Method

Optimize a suffix against a proxy model to maximize an affirmative-response objective (e.g. GCG).
Append the suffix to arbitrary requests; test transfer to the black-box target.
Validate on a benign canary target in a lab; do not deploy against out-of-scope systems.

Payloads templates - adapt to authorized scope

Structure (placeholder - no working suffix shipped) text

<benign request> [optimized-adversarial-suffix]  # suffix is model-specific and generated offline; not included

Why it works

Because inference is differentiable, an attacker with gradient/logit access can search token sequences that push the model toward an affirmative continuation. These suffixes exploit shared representations, so they often transfer to other models - a universal, automated jailbreak rather than a hand-crafted one.

Impact

Automated, repeatable guardrail bypass that generalizes across prompts and models; hard to patch because it targets the model's optimization surface, not a phrase.

Defenses

Adversarial training and input perturbation/paraphrase defenses to break brittle suffixes.
Perplexity/anomaly filters to flag gibberish suffixes; limit logit exposure.
Defense-in-depth - independent output policy and least-privilege tool authorization.

Mappings

OWASP LLM

LLM01 - Prompt Injection

OWASP ASI

ASI01 - Agent Goal Hijack

Agentic Threats

T6 - Intent Breaking & Goal Manipulation

MITRE ATLAS

AML.T0043 - Craft Adversarial Data