{"id":"https://openalex.org/W7214806322","doi":"https://doi.org/10.48550/arxiv.2609.32116","title":"Escaping Alignment: A Physical Trap Model of Best-of-N Jailbreaking","display_name":"Escaping Alignment: A Physical Trap Model of Best-of-N Jailbreaking","publication_year":2026,"publication_date":"2026-09-26","ids":{"openalex":"https://openalex.org/W7214806322","doi":"https://doi.org/10.48550/arxiv.2609.32116"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2609.32116","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.32116","pdf_url":"https://arxiv.org/pdf/2609.32116","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2609.32116","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5014913767","display_name":"Marco Biroli","orcid":"https://orcid.org/0000-0001-9415-2504","observed_orcids":["https://orcid.org/0000-0001-9415-2504"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Biroli, Marco","raw_affiliation_strings":["Physical Science Division Chicago , IL 60637 , USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Physical Science Division Chicago , IL 60637 , USA","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5014913767"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/large-language-model-safety","display_name":"large language model safety","score":0.656000018119812},{"id":"https://openalex.org/keywords/prompt-alignment","display_name":"prompt alignment","score":0.35499998927116394},{"id":"https://openalex.org/keywords/attack-success-rate","display_name":"attack success rate","score":0.6159999966621399},{"id":"https://openalex.org/keywords/power-law-scaling","display_name":"power-law scaling","score":0.6159999966621399},{"id":"https://openalex.org/keywords/barrier-model","display_name":"barrier model","score":0.6769999861717224},{"id":"https://openalex.org/keywords/adversarial-prompts","display_name":"adversarial prompts","score":0.5009999871253967}],"concepts":[{"id":"https://openalex.org/C99844830","wikidata":"https://www.wikidata.org/wiki/Q102441924","display_name":"Scaling","level":2,"score":0.637499988079071},{"id":"https://openalex.org/C122507166","wikidata":"https://www.wikidata.org/wiki/Q628906","display_name":"Crossover","level":2,"score":0.628600001335144},{"id":"https://openalex.org/C151376022","wikidata":"https://www.wikidata.org/wiki/Q168698","display_name":"Exponential function","level":2,"score":0.6140999794006348},{"id":"https://openalex.org/C2779010991","wikidata":"https://www.wikidata.org/wiki/Q2720909","display_name":"Artifact (error)","level":2,"score":0.6093000173568726},{"id":"https://openalex.org/C121864883","wikidata":"https://www.wikidata.org/wiki/Q677916","display_name":"Statistical physics","level":1,"score":0.5232999920845032},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.5019000172615051},{"id":"https://openalex.org/C2780388253","wikidata":"https://www.wikidata.org/wiki/Q5421508","display_name":"Exponent","level":2,"score":0.49380001425743103},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.45089998841285706},{"id":"https://openalex.org/C2777317252","wikidata":"https://www.wikidata.org/wiki/Q18393516","display_name":"Rare events","level":2,"score":0.43470001220703125},{"id":"https://openalex.org/C121099081","wikidata":"https://www.wikidata.org/wiki/Q665580","display_name":"Trap (plumbing)","level":2,"score":0.4259999990463257},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.3962000012397766},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.3702000081539154},{"id":"https://openalex.org/C2780586882","wikidata":"https://www.wikidata.org/wiki/Q7520643","display_name":"Simple (philosophy)","level":2,"score":0.3499999940395355},{"id":"https://openalex.org/C2778755073","wikidata":"https://www.wikidata.org/wiki/Q10858537","display_name":"Scale (ratio)","level":2,"score":0.34769999980926514},{"id":"https://openalex.org/C180188523","wikidata":"https://www.wikidata.org/wiki/Q574576","display_name":"Exponential decay","level":2,"score":0.3301999866962433},{"id":"https://openalex.org/C140779682","wikidata":"https://www.wikidata.org/wiki/Q210868","display_name":"Sampling (signal processing)","level":3,"score":0.3156999945640564},{"id":"https://openalex.org/C75438885","wikidata":"https://www.wikidata.org/wiki/Q3403615","display_name":"Large deviations theory","level":2,"score":0.31450000405311584},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.29330000281333923},{"id":"https://openalex.org/C148043351","wikidata":"https://www.wikidata.org/wiki/Q4456944","display_name":"Current (fluid)","level":2,"score":0.2854999899864197},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.28220000863075256},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.2669999897480011},{"id":"https://openalex.org/C44280652","wikidata":"https://www.wikidata.org/wiki/Q104837","display_name":"Phase (matter)","level":2,"score":0.26440000534057617},{"id":"https://openalex.org/C2777027219","wikidata":"https://www.wikidata.org/wiki/Q1284190","display_name":"Constant (computer programming)","level":2,"score":0.2574000060558319}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2609.32116","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.32116","pdf_url":"https://arxiv.org/pdf/2609.32116","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2609.32116","doi":"https://doi.org/10.48550/arxiv.2609.32116","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2609.32116","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2609.32116","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.32116","pdf_url":"https://arxiv.org/pdf/2609.32116","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7214806322.pdf","grobid_xml":"https://content.openalex.org/works/W7214806322.grobid-xml"},"referenced_works_count":10,"referenced_works":["https://openalex.org/W3126894933","https://openalex.org/W4385374425","https://openalex.org/W4387355345","https://openalex.org/W4401306886","https://openalex.org/W4401306979","https://openalex.org/W4405273924","https://openalex.org/W4405655184","https://openalex.org/W4414973977","https://openalex.org/W7127145980","https://openalex.org/W7135220113"],"related_works":["https://openalex.org/W4405090820","https://openalex.org/W4407123752","https://openalex.org/W7223054139","https://openalex.org/W7135196896","https://openalex.org/W7223041034","https://openalex.org/W7171764807","https://openalex.org/W6929540336","https://openalex.org/W7151214682","https://openalex.org/W7160898367","https://openalex.org/W6966788169"],"abstract_inverted_index":{"Best-of-$N$":[0],"jailbreaking":[1],"(BoN)":[2],"bypasses":[3],"safeguards":[4],"of":[5,13,21,57],"aligned":[6],"models":[7,138],"by":[8,112],"drawing":[9],"$N$":[10],"independent":[11],"augmentations":[12],"an":[14,49,113],"unsafe":[15],"prompt":[16,93],"and":[17,99,144],"sampling":[18],"$M$":[19],"completions":[20],"each.":[22],"Previous":[23],"works":[24],"have":[25],"shown":[26],"that":[27],"the":[28,58,68,81,118,140,151],"attack":[29,73,122],"success":[30],"rate":[31],"(ASR)":[32],"seems":[33],"to":[34,66,131],"follow":[35],"a":[36,54,87,95,102],"power-law":[37],"in":[38],"$N$,":[39,47],"which":[40,52],"we":[41],"challenge.":[42],"The":[43],"exponent":[44],"drifts":[45],"with":[46,48],"exponential":[50],"crossover":[51],"is":[53],"finite-size":[55],"artifact":[56],"adversarial":[59],"dataset.":[60],"Little":[61],"work":[62],"has":[63,94],"been":[64],"done":[65],"explore":[67],"entire":[69,119],"two-budget":[70],"($N,":[71,120],"M$)":[72,121],"surface":[74],"as":[75,77],"well":[76],"its":[78],"dependence":[79],"on":[80,139],"generation":[82],"temperature":[83],"$T$.":[84],"We":[85],"introduce":[86],"simple":[88],"barrier":[89],"model":[90],"where":[91],"each":[92,100,110],"baseline":[96],"safety":[97,115],"level":[98],"augmentation":[101],"random":[103],"thermally":[104],"activated":[105],"barrier.":[106],"Then":[107],"four":[108],"numbers,":[109],"backed":[111],"interpretable":[114],"mechanism,":[116],"determine":[117],"surface.":[123],"They":[124],"extrapolate":[125],"predictions":[126],"from":[127,150],"$N":[128,132],"\\leq":[129],"100$":[130],"=":[133],"10^4$,":[134],"collapse":[135],"five":[136],"distinct":[137],"same":[141],"scaling":[142],"function":[143],"predict":[145],"ASR":[146],"at":[147],"different":[148],"temperatures":[149],"one":[152],"they":[153],"were":[154],"fitted":[155],"at.":[156]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-09-30T00:00:00"}