ECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak Attack
ECHO is an optimization-based jailbreak method that searches over word-level prompt perturbations using response-level harmfulness scores from a HarmSig regressor, rather than the usual token-level “model seems willing to comply” proxy, and reports strong attack success on open-weight LLMs across AdvBench/HarmBench-style evaluations. The key idea is insightful because it optimizes for what the victim actually outputs instead of an indirect affirmative-prefix signal, using a beam search with memory to make that practical in a black-box setting, though its strength is partly tied to the quality/generalization of the HarmSig evaluator and the experiments appear limited to a handful of open-weight models and benchmarked harmfulness definitions.
Abstract
Despite extensive safety alignment, large language models remain vulnerable to jailbreak attacks. Existing optimization-based attacks share a single objective: maximize a token-level proxy of victim compliance---such as the likelihood of an affirmative prefix---computed on the prompt rather than the decoded reply. This proxy cannot distinguish a cautious hedge from a fully actionable harmful answer, leaving the search blind to what the model actually says. We propose ECHO (Evaluation-Conditioned Harmfulness Optimization), which replaces the compliance proxy with response-level, continuous harmfulness scores from HarmSig, a 1.7B regressor grounded in actual harmful capability. ECHO couples HarmSig with five word-level perturbation operators and Keyword-Anchored Beam Search with global top-m memory, under a strict black-box threat model. Across five open-weight victims on AdvBench, ECHO achieves up to 0.898 StrongREJECT mean score and 89.23% HarmBench success. Our code is publicly available at https://github.com/STANWYW/echo.