Boundary Point Jailbreaking: Breaking Black-Box LLM Safeguards with Binary Feedback

Paper: 2602.15001 Authors: Xander Davies, Giorgi Giglemiani, Edmund Lau, Eric Winsor, Geoffrey Irving, Yarin Gal Categories: cs.LG

Abstract

This paper introduces Boundary Point Jailbreaking (BPJ), a groundbreaking automated attack method that successfully compromises state-of-the-art LLM safety systems using minimal information. Unlike existing approaches that require white-box access to model gradients or grey-box access to classifier scores, BPJ operates in a fully black-box setting with only binary feedback: whether the safety classifier flags an interaction or not. The method addresses the fundamental challenge of evaluating attack improvements by creating a curriculum of intermediate targets and strategically selecting “boundary points” that maximize sensitivity to attack strength changes. BPJ demonstrates unprecedented success against robust defenses including Constitutional Classifiers and GPT-5’s input classifier, achieving universal jailbreaks without relying on human-crafted attack templates.

Key Contributions

• First fully black-box automated jailbreak: BPJ requires only binary classifier feedback (flagged/not flagged), eliminating dependencies on gradient access, probability scores, or existing jailbreak libraries
• Curriculum-based attack optimization: Converts target harmful strings into progressively challenging intermediate objectives, enabling systematic attack development
• Boundary point selection strategy: Actively identifies evaluation points that best detect marginal improvements in attack effectiveness
• Universal jailbreak generation: Successfully creates attacks that work across multiple harmful queries without per-query optimization
• Breakthrough against production systems: First automated method to defeat Constitutional Classifiers and GPT-5’s input classifier without human attack seeds

Methodology: How BPJ Works

The core innovation of BPJ lies in its approach to the evaluation problem in adversarial optimization. Traditional gradient-based attacks fail in black-box settings because they cannot assess whether small modifications improve attack success. BPJ solves this through three key mechanisms:

Curriculum Learning for Attacks: Rather than directly optimizing for a harmful target string $s_{\text{target}}$, BPJ constructs a sequence of intermediate targets $s_1, s_2, \ldots, s_n = s_{\text{target}}$ where each $s_i$ is progressively more harmful. This allows the algorithm to build attack capability incrementally, similar to how curriculum learning helps models learn complex tasks.

Boundary Point Identification: For each curriculum stage, BPJ identifies “boundary points” - attack candidates that lie near the decision boundary of the safety classifier. These points are maximally informative because small improvements in attack strength are most likely to flip the classifier’s decision at the boundary. The algorithm maintains a pool of candidate attacks and actively selects which ones to evaluate based on their estimated proximity to the boundary.

Binary Feedback Optimization: With only a single bit of information per query (flag/no flag), BPJ uses the boundary point evaluations to guide search through the attack space. The method employs techniques from active learning and Bayesian optimization to efficiently explore the space of possible prompt modifications, focusing computational budget on the most informative queries.

Results and Effectiveness

BPJ demonstrates remarkable effectiveness against multiple state-of-the-art defense systems:

Constitutional Classifiers: These classifiers, which have withstood thousands of hours of human red teaming, are successfully compromised by BPJ’s automated approach. The algorithm generates universal jailbreaks that work across different harmful queries without requiring per-query optimization.

GPT-5 Input Classifier: BPJ represents the first automated attack to successfully breach GPT-5’s input filtering system without relying on human-generated attack seeds. This is particularly significant given that GPT-5’s defenses were designed with knowledge of previous automated attack methods.

Query Efficiency: While BPJ requires multiple queries during the optimization phase (incurring many flags), the resulting universal jailbreaks can be deployed in single interactions, making them difficult to detect through per-interaction monitoring alone.

Attack Transferability: The universal jailbreaks generated by BPJ show strong transferability, working effectively across different instances of harmful queries and even across different model versions in some cases.

Implications for AI Safety

The success of BPJ reveals critical vulnerabilities in current LLM safety architectures and has profound implications for defense strategies:

Limitations of Classifier-Based Defenses: The paper demonstrates that even robust classifiers that survive extensive human red teaming can be systematically defeated by automated methods with minimal information access. This suggests that classifier-based filtering alone is insufficient for ensuring LLM safety.

The Batch Monitoring Imperative: While BPJ-generated attacks are hard to detect in individual interactions, the optimization process generates many flagged queries. This observation points toward batch-level monitoring and anomaly detection as essential complementary defense mechanisms. Systems should track patterns of failed attempts and flag suspicious optimization-like behavior.

Arms Race Dynamics: BPJ represents a significant escalation in the adversarial arms race between attackers and defenders. The method’s black-box nature means it can be applied by adversaries without insider access to model architectures or training procedures, lowering the barrier to sophisticated attacks.

Defense Research Directions: The paper implicitly suggests several promising defense directions: (1) making classifiers more robust to boundary-seeking behavior, (2) implementing rate limiting and behavioral analysis, (3) developing defenses that are robust to curriculum-based attacks, and (4) creating multi-layered defense systems that don’t rely solely on input filtering.

Takeaways

1. Black-box attacks are more powerful than previously thought: BPJ shows that sophisticated automated jailbreaks can be developed with only binary feedback, eliminating the need for gradient access or probability scores.

2. Curriculum learning applies to adversarial optimization: Breaking down harmful targets into progressive stages enables systematic attack development even in highly constrained information settings.

3. Boundary points are key to efficient black-box optimization: Actively selecting evaluation points near decision boundaries maximizes information gain from limited binary feedback.

4. Single-interaction defenses are insufficient: Effective LLM safety requires combining per-interaction filtering with batch-level monitoring to detect optimization attempts.

5. Universal jailbreaks remain a critical threat: The ability to generate attacks that work across multiple queries without per-query optimization makes defense significantly more challenging.

6. The safety-capability tradeoff persists: As LLMs become more capable, ensuring they remain safe against increasingly sophisticated automated attacks becomes progressively more difficult.