Controlled Decoding Attacks on Black-Box LLMs

Controlled Decoding Attacks on Black-Box LLMs. By Jesson Wang and six others, from the University of Southern California, Adobe, and one other institution. Published on the twenty-ninth of September. Its code repository is worked out: about one hundred source files, with a readme and a licence.

Manipulating next-token probabilities while a large language model generates can bypass its safety alignment. Existing attacks of that kind, though, need access to the model's weights or to its numerical token probabilities. That rules them out for interfaces that return only sampled text, where the caller sees words and never the numbers behind them.

One alternative is to reconstruct the probabilities from samples: ask many times and count what comes back. That has two problems. Finite sampling gives sparse and noisy estimates, so the reconstructed distribution is rough. And repeating the reconstruction at every step of generation runs up substantial query costs, because every step needs its own batch of samples.

An empirical observation points the way. Along successful jailbreak trajectories, the large changes in distribution are concentrated at a small subset of positions. If only a few positions matter, control can be selective. The authors build a framework for jailbreaking through text-only continuation interfaces, the kind that allow repeated sampling and continuing from an assistant prefix. Nothing more than sampled text has to come back from the model.

It has three parts. Sample-Based Distribution Reconstruction combines sampled outputs with a prior over actions that were never observed, which yields a control signal usable despite sparse samples. Risk-Gated Residual Control watches the response prefix as it evolves and decides when to reconstruct and modify the distribution, so that sampling cost is spent only at selected positions.

The third part, Speculative Multi-Token Execution, amortizes calls to the target further. Draft prefixes that need no intervention are verified and accepted, rather than generated one controlled step at a time.

Evaluation covers four target endpoints and three benchmarks. Against the baselines, the framework achieves the highest mean score in most of the comparisons made.

Earlier decoding attacks needed weights or probabilities, which a text-only interface does not expose. This one asks for less: repeated sampling and prefix continuation are enough to rebuild a usable signal, and spending queries only at the few positions where the distribution shifts is what keeps the cost in check.