AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs
AutoDAN-Turbo is a black-box jailbreak method introduced in the ICLR 2025 Spotlight paper titled AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs. Developed by researchers from SaFo-Lab, including Xiaogeng Liu, Peiran Li, Edward Suh, Yevgeniy Vorobeychik, Zhuoqing Mao, Somesh Jha, Patrick McDaniel, Huan Sun, Bo Li, and Chaowei Xiao, the framework is designed to autonomously discover jailbreak strategies without human intervention or predefined constraints. This approach enables it to outperform baseline methods by achieving a 74.3% higher average attack success rate on public benchmarks. The method demonstrates particular effectiveness against GPT-4-1106-turbo, with an 88.5% attack success rate, which further improves to 93.4% when integrated with human-designed strategies.
The implementation is open-source under the MIT License and is available in Python.
The authors emphasize the framework’s ability to function as a unified system, allowing for the seamless incorporation of existing human-designed jailbreak strategies in a plug-and-play manner.
The project’s development timeline includes key milestones such as acceptance at ICLR 2025 in January 2025, followed by its selection as a spotlight presentation in February 2025.
How It Works
AutoDAN-Turbo operates as a lifelong learning agent, continuously refining its jailbreak strategies through self-exploration. Unlike traditional methods that rely on predefined or manually curated strategies, AutoDAN-Turbo dynamically generates and evaluates new approaches without human input. This autonomous discovery process is facilitated by three core components: an attacker, a scorer, and a summarizer, each playing a distinct role in the framework’s operation.
This feedback loop enables AutoDAN-Turbo to iteratively improve its attack capabilities over time.
AutoDAN-Turbo-v1.0 relies on Hugging Face models for its foundation, including the attacker, scorer, summarizer, and target model, while utilizing OpenAI’s text embedding model for processing.
Training and testing in AutoDAN-Turbo are conducted through command-line interfaces, with support for both OpenAI and Microsoft Azure APIs. Users can configure the system by specifying API keys, embedding models, and deployment parameters. The training process involves running the main.py or mainr.py script for AutoDAN-Turbo-v1.0 or AutoDAN-Turbo-R, respectively, with adjustable epochs to control the duration of the learning phase.
Use Cases
AutoDAN-Turbo is primarily designed for red-teaming and security testing of large language models (LLMs). Its ability to autonomously discover and refine jailbreak strategies makes it a valuable tool for security researchers and developers seeking to assess the robustness of their models against adversarial attacks.
The framework’s compatibility with both open-source and proprietary models, such as those from Hugging Face and Deepseek, expands its applicability across different research and industrial settings. This makes it particularly useful for organizations focused on AI security, compliance testing, and adversarial robustness evaluations.
Beyond its technical applications, AutoDAN-Turbo serves as a benchmark for evaluating the resilience of LLMs against evolving attack strategies. Its plug-and-play architecture allows researchers to integrate existing jailbreak techniques, fostering collaboration and innovation in the field of AI security. The framework’s open-source nature under the MIT License encourages community contributions, further accelerating advancements in defensive strategies.
Key Features & Capabilities
- Autonomous Strategy Discovery: AutoDAN-Turbo eliminates the need for predefined jailbreak strategies by autonomously generating and evaluating new approaches through lifelong learning. This capability significantly reduces reliance on human expertise while improving adaptability to diverse model architectures.
- High Attack Success Rates: The framework achieves an 88.5% attack success rate on GPT-4-1106-turbo, with the potential to reach 93.4% when combined with human-designed strategies.
- Unified Framework: AutoDAN-Turbo supports the integration of existing jailbreak strategies in a plug-and-play manner, allowing users to combine automated discovery with manually curated techniques.
- Support for Multiple APIs: The implementation provides seamless integration with both OpenAI and Microsoft Azure APIs, enabling users to deploy the framework using their preferred cloud services. This includes configuration options for embedding models, API keys, and deployment parameters.
- Open-Source and Permissive Licensing: Released under the MIT License, AutoDAN-Turbo is freely accessible to the research community.
- Version-Specific Optimizations: AutoDAN-Turbo-R introduces enhancements tailored to modern reasoning models, such as Deepseek-R1, while maintaining backward compatibility with earlier versions like AutoDAN-Turbo-v1.0, which relies on Hugging Face models.