[NAACL 2025] SeqAR: Jailbreak LLMs with Sequential Auto-Generated Characters

The official repository containing the introduction and code for our NAACL 2025 paper: SeqAR: Jailbreak LLMs with Sequential Auto-Generated Characters.

| 🔥 News | 💡 Motivation | 🔖 Method |

| ⚡️ Quick Start | 📓 Citation | 📃 Paper |

🔥 News

• Jan 2025: Our paper has been accepted by NAACL 2025 main conference.
• Sep 2024: We released our code and quick start.
• Jul 2024: We released our paper on arxiv.

💡 Motivation

• LLMs are more susceptible to distractions when responding as multiple characters sequentially.
• Different characters specialize in distinct malicious instructions. The combination of different characters further amplifies the effectiveness of attack.

🔖 SeqAR

SeqAR: Sequential Auto-generated chaRacters

• Design and optimize the jailbreak templates automatically.
• Jailbreak target LLMs by asking them to act as malicious characters sequentially.

⚡️ Quick Start

Requirments

Install all the packages from requirments.txt

conda create -n seqar python=3.10 -y
conda activate seqar
git clone https://github.com/sufenlp/SeqAR.git
cd SeqAR
pip install -r requirements.txt

Data

• The datasets used in SeqAR include:
  • AdvBench
  • GPTFUZZER
• You can add more datasets in ./data referring to the existed csv or jsonl files.

Model

• The models used in SeqAR include:
  • LLaMA-2-7b
  • Vicuna-13b
  • ChatGPT-Turbo
  • GPT-4
• Download model weights from huggingface and add paths to ./src/utils/utils
• You can add more LLMs in ./src/base_llm referring to the existed codes.

Experiment Config

• Before jailbreak the target LLMs, a YAML file needs to be created in the workspace folder to configure the experimental settings. An example in ./workspace/example is shown below.

# -------------- Base set ----------------------
BaseConfig:
  dataset_pth: "data/advbench/final_train.csv"
  dataset_length: 20
  classifier_device: "cuda"
  max_iter_step: 11
  max_iter_character: 5
  converge: 4
  beam_size: 1


# -------------- Optimization set --------------
OptConfig:
  attacker_name: "vllm-llama-2"
  max_n_tokens: 2048
  temperature: 1.0
  top_p: 0.95

  opt_output_length: 200
  opt_character_gen_num: 4
  opt_trajectory_length: 4
  use_exist: False
  random_character_first: False
  keep_trajectory: True


# -------------- Evaluation set ----------------
EvalConfig:
  evaluator_name: "vllm-llama-2"
  eval_template_name: "final.fm"
  system_prompt: "You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe. Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature.\n\nIf a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information."  # LLaMA-2 official safety system prompt
  max_n_tokens: 4096
  temperature: 0.00
  top_p: 0.95
  eval_batch: 20
  gen_num: 1

• Detailed experiment logs will be recorded in the workspace folder, where you can find the characters generated during the jailbreak optimization process and the results of different character combinations used to attack the model.

Run SeqAR

• Optimization: Get the jailbreak characters.

PYTHONPATH=your_project_pth \
python more_character.py \
    -p "folder with your experiment config"

• Evaluation: Test the jailbreak performance of characters' combination.

PYTHONPATH=your_project_pth \
python evaluate.py \
    -p "folder with experiment finished" \
    -m "llama_vllm" \
    -c 2

📓 Citation

If you find this repo useful for your research, please cite us as:

@inproceedings{yang-etal-2025-seqar,
    title = "{S}eq{AR}: Jailbreak {LLM}s with Sequential Auto-Generated Characters",
    author = "Yang, Yan  and  Xiao, Zeguan  and  Lu, Xin  and  Wang, Hongru  and  Wei, Xuetao  and  Huang, Hailiang  and  Chen, Guanhua  and  Chen, Yun",
    editor = "Chiruzzo, Luis  and  Ritter, Alan  and  Wang, Lu",
    booktitle = "Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers)",
    month = apr,
    year = "2025",
    address = "Albuquerque, New Mexico",
    publisher = "Association for Computational Linguistics",
    url = "https://aclanthology.org/2025.naacl-long.42/",
    pages = "912--931",
    ISBN = "979-8-89176-189-6"
}