GCG Attack

GCG is fundamentally a white-box attack, meaning it requires full access to the model's gradients and internal weights. The attacker must be able to compute the loss with respect to the input token embeddings. This distinguishes it from black-box methods like PAIR or TAP that only require API access. The attack leverages gradient information to identify which token substitutions will most effectively steer the model toward generating the target harmful sequence.

The core algorithm operates by:

• Computing the gradient of the adversarial loss with respect to each token in the suffix
• Identifying a set of candidate token replacements for each position using the gradient signal
• Evaluating all candidates and greedily selecting the substitution that minimizes loss
• This process repeats for hundreds of iterations, progressively refining the suffix until the model reliably produces the target output

A defining property of GCG is its ability to produce universal suffixes—a single optimized token sequence that, when appended to any harmful prompt, reliably induces the target behavior. This transferability across prompts makes GCG particularly dangerous. A suffix optimized on one set of harmful requests often generalizes to unseen prompts, enabling zero-shot jailbreaking without per-prompt optimization.

GCG suffixes exhibit cross-prompt transferability: a suffix optimized against a training set of harmful prompts generalizes to held-out test prompts. More critically, they demonstrate cross-model transferability—suffixes computed on open-source models like Vicuna-7B or Llama 2 often transfer to other models, including black-box commercial systems. This occurs because adversarial patterns exploit shared vulnerabilities in the token embedding space learned during pretraining.

The attack optimizes for a specific target string that indicates compliance, such as 'Sure, here is how to...' followed by the harmful content. The loss function maximizes the log probability of this target sequence given the adversarial input. This formulation exploits the model's tendency toward helpful completion—once the model begins with an affirmative response, it is statistically likely to continue generating the harmful content that follows.

GCG requires significant compute: a typical attack runs for 500 optimization steps, evaluating hundreds of candidate token substitutions per step. However, once a universal suffix is discovered, it can be reused indefinitely at near-zero marginal cost. This asymmetry—high upfront compute for a reusable exploit—makes GCG a preferred method for attackers who can amortize the optimization cost across many targets.