Adversarial suffix

A token sequence optimized to increase the chance that a model follows a target request, often despite the model's usual refusal behavior.

Adversarial-suffix research searches over token sequences attached to a request and measures whether they change model behavior. Greedy Coordinate Gradient and related methods use access to an open model to optimize sequences that may look awkward or meaningless to a reader. Some attacks have transferred to other models, including closed systems, but transfer and success rates vary across targets, defenses, prompts, and time. A suffix is an empirical attack input, not a precise instruction that works on every model.

Builder example

Keyword filters and human readability are weak boundaries because an optimized input need not resemble a familiar jailbreak. Input screening can still remove known attacks or reduce volume, but it should not carry the whole security claim. Limit reachable tools and data, validate sensitive effects outside the model, monitor attack results, and repeat red-team tests after model or prompt changes.

A red team finds a suffix that gets a model to answer a disallowed request even though the visible request is blocked.

Use layered defenses: model safety, input filtering, output checks, tool limits, evals, and red-team regression tests.

Common confusion: Adversarial suffixes and natural-language jailbreaks can pursue the same outcome through different search methods, and the categories can overlap. The defining feature is optimization against model behavior, not invisibility to people or guaranteed transfer to another model.