A Gradient-Calibrated Adversarial Prompt Optimization Framework for Large Language Model Safety Evaluation

Abstract

Large language models (LLMs) may still produce unsafe responses under optimized adversarial prompts, even after safety alignment. Existing gradient-based jailbreak evaluation methods usually use raw gradient signals for discrete prompt search, but raw gradients may be unstable in both magnitude and direction. This paper proposes a gradient-calibrated adversarial prompt optimization framework for LLM safety evaluation. The framework adopts REINFORCE-style randomized discrete prompt optimization as the parent objective and inserts a unified calibration interface before gradient-derived token-search signals are used. We instantiate this interface with two complementary primitives: LSGM for layer-wise magnitude calibration and LiLA for representation-space directional calibration. Experiments on HarmBench show that joint calibration improves attack success rate on multiple open-source safety-aligned models. Ablation results further suggest that the two primitives are more stable when used jointly than when used alone. The framework provides a compact white-box diagnostic tool for analyzing gradient quality in discrete adversarial prompt optimization, while transfer and defense results reveal clear limitations in generalizability and practical robustness.