Adversarial Déjà Vu: Jailbreak Dictionary Learning for Stronger Generalization to Unseen Attacks

Novel jailbreaks are largely recombinations of older attack techniques: The paper analyzed 32 attack papers over two years and found that new, previously unseen jailbreaks can be explained as combinations of adversarial "skills" from earlier attacks, suggesting that truly novel attack methods are rarer than they appear.

Traditional adversarial training has significant limitations: The paper identifies that the dominant approach to AI safety—adversarial training—often fails against newly developed jailbreaks in practice due to optimization challenges and difficulties in defining realistic threat models, indicating that current defense strategies need fundamental rethinking.

A dictionary of reusable attack primitives can improve defenses: By extracting and compressing adversarial techniques into a sparse dictionary of interpretable primitives (with human-readable descriptions), researchers can better understand and defend against future attacks by training models on diverse combinations of these known skills rather than isolated attacks.

Compositional training shows promise for unseen attacks: The proposed method (ASCoT) substantially improves robustness against unseen jailbreaks, including complex multi-turn attacks, by training on diverse compositions of skill primitives—suggesting this compositional approach is more effective than current methods at generalizing to novel threats.

Understanding attack patterns enables better safety measures: The monotonic increase in explanatory power as skill coverage grows suggests that systematically cataloging and understanding how attackers combine techniques could help AI developers anticipate and defend against future jailbreak attempts more effectively.