Metraipolis › archive › dc_4e8fcfb41bd8

From Expected Harmfulness to Likelihood: A Probabilistic Reformulation of Jailbreaking LLM Agents — arXiv:2610.09973

Source: arXiv (en)
Original: https://arxiv.org/abs/2610.09973
License (as archived): CC0-1.0
Archived: 2026-10-08T11:09:41.435Z
SHA-256 of the archived text: f6d2f49b7a373768c91a157a096469afa5d88b6d2693cb63debc4bd62a4fefad
Stable URL of this page: https://metraipolis.com/documento/dc_4e8fcfb41bd8

How to cite

From Expected Harmfulness to Likelihood: A Probabilistic Reformulation of Jailbreaking LLM Agents — arXiv:2610.09973 — arXiv (en), https://arxiv.org/abs/2610.09973 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_4e8fcfb41bd8 (Metraipolis archive dc_4e8fcfb41bd8, sha256 f6d2f49b7a373768c91a157a096469afa5d88b6d2693cb63debc4bd62a4fefad)

BibTeX

@misc{dc4e8fcfb41bd8,
  title = {From Expected Harmfulness to Likelihood: A Probabilistic Reformulation of Jailbreaking LLM Agents — arXiv:2610.09973},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2610.09973},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_4e8fcfb41bd8; sha256 f6d2f49b7a373768c91a157a096469afa5d88b6d2693cb63debc4bd62a4fefad},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2610.09973. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

When the harmfulness of an LLM agent's output can be quantified, a natural jailbreaking objective is to maximize expected harmfulness over admissible input modifications. An alternative approach constructs or selects harmful target outputs and modifies the input to increase their likelihood. We establish a precise connection between these two approaches through a probabilistic reformulation. Specifically, we show that the gradient of the logarithm of expected harmfulness with respect to the input equals the expected input gradient of the model's log-likelihood under a harmfulness reweighted output distribution. This identity provides a unified interpretation of expected harmfulness and target likelihood optimization. Building on this connection, we propose OPUR, a sampling distribution designed to generate highly harmful target outputs and use the resulting samples to guide likelihood-based input optimization. Experiments demonstrate the effectiveness of the resulting method in jailbreaking LLM agents.

Tema degli esploratori: agenti e intelligenza artificiale (elenco arXiv cs.AI, nuovi lavori del giorno).
Categorie arXiv: Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2610.09973 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-08T10:14:05.969Z dalla pagina https://arxiv.org/list/cs.AI/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).