统一离散文本优化框架,让模型攻防研究更高效。
TROPT: An Open Framework for Unifying and Advancing Discrete Text Optimization

- 构建统一接口,可灵活替换模型、目标与优化器。
- 内置30+优化方案,覆盖狱警攻击与模型探查等场景。
- 支持跨领域迁移,助力新应用快速落地。
离散文本触发优化——通过搜索特定文本序列引导模型达成目标——是大模型红队测试(如LLM越狱)、审计与可解释性研究的核心。然而现有优化器分散在各研究代码库中,仅部分开源,且变体繁多,集成与对比成本高,阻碍了应用与演进。为此,我们提出TROPT,首个开源的统一框架,标准化离散优化器的执行与开发。TROPT通过单一接口实现组件自由替换(模型、目标、优化器),支持端到端优化流程自定义,扩展至多领域。当前包含30+优化配方,基于15+优化器(涵盖白盒至黑盒)和15+损失函数,覆盖狱警攻击、模型内部探测等应用。我们利用TROPT开展两项研究:(i) 大规模可控实验对比并改进LLM越狱策略,发现被低估的有效方法;(ii) 将优化器从原领域(如LLM越狱)迁移至新领域(如语料污染嵌入模型)。TROPT显著降低离散文本优化的采用与研发门槛。
原文摘要 · Abstract (English)
Discrete text-trigger optimization -- searching for text sequences that, when ingested by a model, steer it toward a specified objective -- underpins model red-teaming (e.g., LLM jailbreaks), as well as auditing and interpretability. However, the current state of discrete optimizers hinders their adoption and progress. First, existing optimizers, when open-sourced at all, are scattered across research codebases tied to specific models, objectives, and problem domains. Second, optimizer variants proliferate, each requiring engineering overhead to use or extend, and remaining hard to compare head-to-head. Together, these raise the bar for adopting optimizers in existing or new domains, and for advancing them via new strategies. We address these gaps with TROPT, the first open-source framework that unifies discrete optimizers' execution and standardizes their development under a single interface. TROPT makes it easy to customize end-to-end optimization recipes by swapping any component -- models, objectives, and optimizers -- extending its reach across domains and new applications. TROPT currently ships with 30+ optimization recipes -- covering applications such as jailbreaking and probing model internals -- built from 15+ optimizers (spanning white-box to black-box access) and 15+ losses, from foundational to state-of-the-art methods. Demonstrating its utility, we leverage TROPT in several studies: (i) controlled, large-scale experiments comparing and enhancing optimization strategies for LLM jailbreaks, revealing potent-yet-underadopted techniques; and (ii) porting optimizers from one domain (e.g., LLM jailbreak) to new domains (e.g., corpus-poisoning embedding model). In all, TROPT significantly lowers the barrier to adopting and advancing discrete text optimization.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。