ECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak Attack

Yuanwei Wu, Lingdong Huang, Yunlong Mao, Kanye Ye Wang, Jingyu Hua +1 more
10/16/2026
cs.CRcs.CL

Official code: STANWYW/echo (2 stars, last commit 2026-10-20).

Abstract

Despite extensive safety alignment, large language models remain vulnerable to jailbreak attacks. Existing optimization-based attacks share a single objective: maximize a token-level proxy of victim compliance---such as the likelihood of an affirmative prefix---computed on the prompt rather than the decoded reply. This proxy cannot distinguish a cautious hedge from a fully actionable harmful answer, leaving the search blind to what the model actually says. We propose ECHO (Evaluation-Conditioned Harmfulness Optimization), which replaces the compliance proxy with response-level, continuous harmfulness scores from HarmSig, a 1.7B regressor grounded in actual harmful capability. ECHO couples HarmSig with five word-level perturbation operators and Keyword-Anchored Beam Search with global top-m memory, under a strict black-box threat model. Across five open-weight victims on AdvBench, ECHO achieves up to 0.898 StrongREJECT mean score and 89.23% HarmBench success. Our code is publicly available at https://github.com/STANWYW/echo.

View on arXivView PDF

Code Implementations(1)

STANWYW/echoOfficial100%

ECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak Attack

21TeX, ShellAug 26, 20264 days ago

Similar Papers

LASH: Adaptive Semantic Hybridization for Black-Box Jailbreaking of Large Language Models

89% match2026

How Jailbreak Attacks Inform Safety Alignment: A Defender-Centric, Shapley-Based Evaluation of Jailbreak Contributions

89% match2026

Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction

89% match2 repos1162024

ContextualJailbreak: Evolutionary Red-Teaming via Simulated Conversational Priming

89% match2026

One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs

88% match1 repo92025

Security Assessment of DeepSeek and GPT Series Models against Jailbreak Attacks

88% match2025

Cite this paper

@article{wu2026echo,
  title  = {ECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak Attack},
  author = {Yuanwei Wu and Lingdong Huang and Yunlong Mao and Kanye Ye Wang and Jingyu Hua and Sheng Zhong},
  year   = {2026},
  eprint = {2610.23030},
  archivePrefix = {arXiv},
  url    = {http://arxiv.org/abs/2610.23030v1}
}

Add a badge to your README

Shows whether official code is linked for this paper.

Code of Paper badge
[![Code of Paper](https://codeofpaper.com/badge/2610.23030.svg)](https://codeofpaper.com/paper/2610.23030)

Discussion