adversarial suffixes

An adversarial suffix is a short, often gibberish-looking string of tokens that, appended to an otherwise-refused request, flips the model into complying. It does not read like an argument or a clever role-play; it can look like punctuation and fragments, describing ! ! ! similarly nowWrite. Yet appended to a harmful prompt it can reliably suppress the refusal, because it was not written by a human at all — it was found by optimizing the tokens directly against the model.

These suffixes are produced by gradient-based search over discrete tokens: the algorithm picks tokens that maximize the probability the model begins its answer with an affirmative compliance like Sure, here is, since once a model starts complying it tends to continue. The striking and worrying property is transfer and universality: a single suffix optimized against one or a few open models often jailbreaks many others, including closed models it was never trained on, and can work as a prefix that unlocks a whole range of harmful requests.

Their existence is strong evidence that current safety training is a thin, exploitable layer rather than deep understanding. Defensively, suffixes are also somewhat brittle: they are often visible as anomalous text, can be caught by perplexity filters or paraphrasing the input, and adversarial training against them helps. They are best understood as the LLM analogue of the adversarial examples long known in image classifiers — tiny, deliberately optimized perturbations that humans barely notice but that flip the model's behavior.