# LARGO: Latent Adversarial Reflection through Gradient Optimization for Jailbreaking LLMs Source: [LARGO: Latent Adversarial Reflection through Gradient Optimization for Jailbreaking LLMs]() Collection index: [llms.txt]() Data updated: 2025-10-26T04:42:14.951Z Authors: Ran Li, Hao Wang, Chengzhi Mao Published: 2025-05-16T04:12:16.000Z ## Abstract Efficient red-teaming method to uncover vulnerabilities in Large Language Models (LLMs) is crucial. While recent attacks often use LLMs as optimizers, the discrete language space make gradient-based methods struggle. We introduce LARGO (Latent Adversarial Reflection through Gradient Optimization), a novel latent self-reflection attack that reasserts the power of gradient-based optimization for generating fluent jailbreaking prompts. By operating within the LLM's continuous latent space, LARGO first optimizes an adversarial latent vector and then recursively call the same LLM to decode the latent into natural language. This methodology yields a fast, effective, and transferable attack that produces fluent and stealthy prompts. On standard benchmarks like AdvBench and JailbreakBench, LARGO surpasses leading jailbreaking techniques, including AutoDAN, by 44 points in attack success rate. Our findings demonstrate a potent alternative to agentic LLM prompting, highlighting the efficacy of interpreting and attacking LLM internals through gradient optimization. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Open-ended MCQA on MMLU (16 subjects filtered)](): Open-ended MCQA; MMLU 16 subjects filtered; ASR@30: 84.71. ## Original sources and implementation [Original paper]() [PDF]()