<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-04597574v3</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-15T05:02:14+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">QROA: A Black-Box Query-Response Optimization Attack on LLMs</title>
            <author role="crp">
              <persName>
                <forename type="first">Hussein</forename>
                <surname>Jawad</surname>
              </persName>
              <email type="md5">07c6df27906785e936e1d7f471a3764a</email>
              <email type="domain">capgemini.com</email>
              <idno type="idhal" notation="numeric">1388212</idno>
              <idno type="halauthorid" notation="string">3164241-1388212</idno>
              <affiliation ref="#struct-1193648"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Nicolas</forename>
                <forename type="middle">J-B.</forename>
                <surname>Brunel</surname>
              </persName>
              <email type="md5">b5ab65b95fb7313d141f49facef38d5b</email>
              <email type="domain">ensiie.fr</email>
              <idno type="idhal" notation="string">nicolas-brunel</idno>
              <idno type="idhal" notation="numeric">18479</idno>
              <idno type="halauthorid" notation="string">23383-18479</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-2840-8484</idno>
              <idno type="IDREF">https://www.idref.fr/110359720</idno>
              <idno type="VIAF">https://viaf.org/viaf/197964506</idno>
              <idno type="ISNI">http://isni.org/isni/0000000140280615</idno>
              <idno type="ARXIV">https://arxiv.org/a/brunel_n_1</idno>
              <affiliation ref="#struct-245277"/>
              <affiliation ref="#struct-1193648"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Nicolas</forename>
                <surname>Brunel</surname>
              </persName>
              <email type="md5">b5ab65b95fb7313d141f49facef38d5b</email>
              <email type="domain">ensiie.fr</email>
            </editor>
            <funder>Capgemini Invent</funder>
          </titleStmt>
          <editionStmt>
            <edition n="v3" type="current">
              <date type="whenSubmitted">2024-06-03 08:56:46</date>
              <date type="whenWritten">2024-05-22</date>
              <date type="whenModified">2025-05-07 09:52:02</date>
              <date type="whenReleased">2025-01-20 09:01:04</date>
              <date type="whenProduced">2024-05-22</date>
              <date type="whenEndEmbargoed">2024-06-03</date>
              <ref type="file" target="https://hal.science/hal-04597574v3/document">
                <date notBefore="2024-06-03"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-04597574v3/file/attack_2024.pdf" id="file-4597574-3990374">
                <date notBefore="2024-06-03"/>
              </ref>
              <ref type="externalLink" target="http://arxiv.org/pdf/2406.02044"/>
            </edition>
            <edition n="v1">
              <date type="whenSubmitted">2024-06-03 12:10:31</date>
            </edition>
            <edition n="v2">
              <date type="whenSubmitted">2024-10-16 23:20:33</date>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="174314">
                <persName>
                  <forename>Nicolas</forename>
                  <surname>Brunel</surname>
                </persName>
                <email type="md5">b5ab65b95fb7313d141f49facef38d5b</email>
                <email type="domain">ensiie.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-04597574</idno>
            <idno type="halUri">https://hal.science/hal-04597574</idno>
            <idno type="halBibtex">jawad:hal-04597574</idno>
            <idno type="halRefHtml">2024</idno>
            <idno type="halRef">2024</idno>
            <availability status="restricted">
              <licence target="https://about.hal.science/hal-authorisation-v1/">HAL Authorization<ref corresp="#file-4597574-3990374"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="CNRS">CNRS - Centre national de la recherche scientifique</idno>
            <idno type="stamp" n="UNIV-EVRY">Université d'Evry-Val d'Essonne</idno>
            <idno type="stamp" n="INRA">INRA - Institut national de la recherche agronomique</idno>
            <idno type="stamp" n="INSMI">CNRS-INSMI - INstitut des Sciences Mathématiques et de leurs Interactions</idno>
            <idno type="stamp" n="LAMME" corresp="UNIV-EVRY">Laboratoire de Mathématiques et Modélisation d'Évry</idno>
            <idno type="stamp" n="UNIV-PARIS-SACLAY">Université Paris-Saclay</idno>
            <idno type="stamp" n="AGREENIUM">Archive ouverte en agrobiosciences</idno>
            <idno type="stamp" n="UNIV-EVRY-SACLAY" corresp="UNIV-PARIS-SACLAY">UNIV-EVRY-SACLAY</idno>
            <idno type="stamp" n="INRAE">Institut National de Recherche en Agriculture, Alimentation et Environnement</idno>
            <idno type="stamp" n="MATHNUM">Département MathNum</idno>
            <idno type="stamp" n="RESEAU-EAU">Réseau "Systèmes Agricoles et Eau"</idno>
            <idno type="stamp" n="ENSIIE">ENSIIE</idno>
          </seriesStmt>
          <notesStmt/>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">QROA: A Black-Box Query-Response Optimization Attack on LLMs</title>
                <author role="crp">
                  <persName>
                    <forename type="first">Hussein</forename>
                    <surname>Jawad</surname>
                  </persName>
                  <email type="md5">07c6df27906785e936e1d7f471a3764a</email>
                  <email type="domain">capgemini.com</email>
                  <idno type="idhal" notation="numeric">1388212</idno>
                  <idno type="halauthorid" notation="string">3164241-1388212</idno>
                  <affiliation ref="#struct-1193648"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Nicolas</forename>
                    <forename type="middle">J-B.</forename>
                    <surname>Brunel</surname>
                  </persName>
                  <email type="md5">b5ab65b95fb7313d141f49facef38d5b</email>
                  <email type="domain">ensiie.fr</email>
                  <idno type="idhal" notation="string">nicolas-brunel</idno>
                  <idno type="idhal" notation="numeric">18479</idno>
                  <idno type="halauthorid" notation="string">23383-18479</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-2840-8484</idno>
                  <idno type="IDREF">https://www.idref.fr/110359720</idno>
                  <idno type="VIAF">https://viaf.org/viaf/197964506</idno>
                  <idno type="ISNI">http://isni.org/isni/0000000140280615</idno>
                  <idno type="ARXIV">https://arxiv.org/a/brunel_n_1</idno>
                  <affiliation ref="#struct-245277"/>
                  <affiliation ref="#struct-1193648"/>
                </author>
              </analytic>
              <monogr>
                <imprint/>
              </monogr>
              <idno type="arxiv">2406.02044</idno>
              <ref target="https://github.com/qroa/qroa" type="seeAlso"/>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Large Language Model</term>
                <term xml:lang="en">Attack</term>
                <term xml:lang="en">Jailbreak</term>
                <term xml:lang="en">reinforcement learning</term>
              </keywords>
              <classCode scheme="halDomain" n="info.info-ai">Computer Science [cs]/Artificial Intelligence [cs.AI]</classCode>
              <classCode scheme="halDomain" n="info.info-cl">Computer Science [cs]/Computation and Language [cs.CL]</classCode>
              <classCode scheme="halDomain" n="info.info-lg">Computer Science [cs]/Machine Learning [cs.LG]</classCode>
              <classCode scheme="halTypology" n="UNDEFINED">Preprints, Working Papers, ...</classCode>
              <classCode scheme="halOldTypology" n="UNDEFINED">Preprints, Working Papers, ...</classCode>
              <classCode scheme="halTreeTypology" n="UNDEFINED.PREPRINT">Preprints, Working Papers, ... - Preprint</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Large Language Models (LLMs) have surged in popularity in recent months, yet they possess concerning capabilities for generating harmful content when manipulated. This study introduces the Query-Response Optimization Attack (QROA), an optimization-based strategy designed to exploit LLMs through a black-box, query-only interaction. QROA adds an optimized trigger to a malicious instruction to compel the LLM to generate harmful content. Unlike previous approaches, QROA does not require access to the model's logit information or any other internal data and operates solely through the standard query-response interface of LLMs. Inspired by deep Q-learning and Greedy coordinate descent, the method iteratively updates tokens to maximize a designed reward function. We tested our method on various LLMs such as Vicuna, Falcon, and Mistral, achieving an Attack Success Rate (ASR) over 80\%. We also tested the model against Llama2-chat, the fine-tuned version of Llama2 designed to resist Jailbreak attacks, achieving good ASR with a suboptimal initial trigger seed. This study demonstrates the feasibility of generating jailbreak attacks against deployed LLMs in the public domain using black-box optimization methods, enabling more comprehensive safety testing of LLMs.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="laboratory" xml:id="struct-1193648" status="INCOMING">
          <orgName>Capgemini Invent,</orgName>
          <desc>
            <address>
              <addrLine>147, quai du Président Roosevelt92130 Issy-les-MoulineauxFrance.</addrLine>
              <country key="FR"/>
            </address>
          </desc>
          <listRelation>
            <relation active="#struct-356207" type="direct"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-245277" status="OLD">
          <orgName>Laboratoire de Mathématiques et Modélisation d'Evry</orgName>
          <orgName type="acronym">LaMME</orgName>
          <date type="start">2018-01-01</date>
          <date type="end">2019-12-31</date>
          <desc>
            <address>
              <addrLine>23 bvd de France 91 037 Évry</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://stat.genopole.cnrs.fr/</ref>
          </desc>
          <listRelation>
            <relation name="USC1152" active="#struct-92114" type="direct"/>
            <relation active="#struct-179741" type="direct"/>
            <relation active="#struct-300306" type="direct"/>
            <relation name="UMR8071" active="#struct-441569" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-356207" status="VALID">
          <orgName>Capgemini</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.capgemini.com/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-92114" status="OLD">
          <idno type="ROR">https://ror.org/01x3gbx83</idno>
          <orgName>Institut National de la Recherche Agronomique</orgName>
          <orgName type="acronym">INRA</orgName>
          <date type="start">1946-05-18</date>
          <date type="end">2019-12-31</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inra.fr</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-179741" status="VALID">
          <orgName>Ecole Nationale Supérieure d'Informatique pour l'Industrie et l'Entreprise</orgName>
          <orgName type="acronym">ENSIIE</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.ensiie.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-300306" status="VALID">
          <idno type="IdRef">030820529</idno>
          <idno type="ISNI">0000000121805818</idno>
          <idno type="ROR">https://ror.org/00e96v939</idno>
          <idno type="Wikidata">Q1531014</idno>
          <orgName>Université d'Évry-Val-d'Essonne</orgName>
          <orgName type="acronym">UEVE</orgName>
          <date type="start">1991-07-22</date>
          <desc>
            <address>
              <addrLine>Boulevard François Mitterrand 91025 Evry Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.univ-evry.fr</ref>
          </desc>
        </org>
        <org type="regroupinstitution" xml:id="struct-441569" status="VALID">
          <idno type="IdRef">02636817X</idno>
          <idno type="ISNI">0000000122597504</idno>
          <idno type="ROR">https://ror.org/02feahw73</idno>
          <orgName>Centre National de la Recherche Scientifique</orgName>
          <orgName type="acronym">CNRS</orgName>
          <date type="start">1939-10-19</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.cnrs.fr/</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>