SlotGCG Jailbreak Framework

• SlotGCG is a jailbreak attack framework for large language models that redefines adversarial insertion by treating prompt slots as optimization variables.
• It introduces the Vulnerable Slot Score (VSS) to quantify slot vulnerability, allowing token budgets to be allocated effectively across multiple insertion points.
• The framework integrates multi-slot token allocation with gradient-based optimization, achieving higher attack success rates and faster convergence than fixed-suffix methods.

SlotGCG is a jailbreak-attack framework for LLMs that treats prompt position as an explicit optimization variable rather than assuming that adversarial tokens should be appended only as a suffix. Introduced in "SlotGCG: Exploiting the Positional Vulnerability in LLMs for Jailbreak Attacks" (Jeong et al., 4 Jun 2026), it is built on the empirical claim that LLMs exhibit nonuniform sensitivity to inserted tokens across different prompt positions, or slots. The method formalizes this positional effect through the Vulnerable Slot Score (VSS), uses VSS to allocate an adversarial token budget across the most vulnerable insertion points, and then applies a GCG-style discrete optimization attack on the resulting multi-slot prompt. The paper reports higher Attack Success Rate (ASR), faster convergence, and stronger performance under multiple defenses than fixed-suffix baselines (Jeong et al., 4 Jun 2026).

1. Positional vulnerability and the definition of a slot

SlotGCG begins from the observation that optimization-based attacks such as Greedy Coordinate Gradient (GCG) have generally focused on inserting adversarial tokens at a fixed insertion point, typically the prompt suffix, leaving the effect of inserting tokens at other positions unexplored (Jeong et al., 4 Jun 2026). The central object of analysis is therefore the slot, defined as a candidate insertion position within a prompt.

Given a prompt token sequence $x_{1:l} = [x_1, x_2, \dots, x_L]$, the method defines $L+1$ insertion slots,

$S = \{0,1,\dots,L\},$

where slot $0$ is immediately before $x_1$, slot $s$ for $1 \le s \le L-1$ lies between $x_s$ and $x_{s+1}$, and slot $L$ is after $L+1$0 (Jeong et al., 4 Jun 2026). Inserting a sequence of $L+1$1 adversarial tokens $L+1$2 at slot $L+1$3 is denoted

$L+1$4

The framework also handles multi-slot insertion. When multiple sequences $L+1$5 are inserted at increasing slots $L+1$6, insertion is applied right-to-left so that earlier insertions do not shift the intended slot indices: $L+1$7 This right-to-left convention is operationally important because SlotGCG freezes the chosen insertion sites before the subsequent token optimization phase.

A common simplification in prior optimization-based jailbreak work is that the suffix is the natural or sufficient attack locus. SlotGCG directly contests that assumption by treating slot selection as part of the attack surface. This suggests that prompt structure, not merely adversarial token identity, can be a first-order factor in jailbreak efficacy.

2. Vulnerable Slot Score

To rank insertion sites by their inherent vulnerability, SlotGCG introduces the Vulnerable Slot Score (VSS), which measures the attention that contextual tokens devote to probing tokens inserted at each slot (Jeong et al., 4 Jun 2026). For a candidate slot $L+1$8 into which a probe sequence $L+1$9 is inserted, VSS is defined as

$S = \{0,1,\dots,L\},$0

The terms are specified as follows. $S = \{0,1,\dots,L\},$1 is the attention weight in layer $S = \{0,1,\dots,L\},$2 and head $S = \{0,1,\dots,L\},$3 from token $S = \{0,1,\dots,L\},$4 to token $S = \{0,1,\dots,L\},$5. $S = \{0,1,\dots,L\},$6 denotes the upper-half layers, described as the region where high-level semantics and refusal logic emerge. $S = \{0,1,\dots,L\},$7 indexes the “after-chat” template tokens, namely the system↔user wrapper that immediately precedes generation (Jeong et al., 4 Jun 2026).

The interpretation is explicit: a larger $S = \{0,1,\dots,L\},$8 indicates that tokens inserted at slot $S = \{0,1,\dots,L\},$9 receive strong attention from the generation-influencing context, and this empirically correlates with lower adversarial loss and higher attack success. In effect, VSS is a positional prior over where adversarial content is most likely to perturb the model’s refusal and generation behavior.

The paper’s ablations further report that using upper-half layers yields the highest ASR, while lower-half or random subsets perform 10–20 percentage points worse. It also reports Pearson $0$0–$0$1 between VSS at initialization and at the end of optimization across prompts, which is taken as evidence that slot vulnerability is prompt-intrinsic rather than merely a byproduct of the optimization trajectory (Jeong et al., 4 Jun 2026). A plausible implication is that slot quality can be estimated before any expensive adversarial search is performed.

3. SlotGCG algorithm

SlotGCG extends any gradient-based discrete optimization attack by separating the attack into slot discovery, token allocation, and targeted token optimization (Jeong et al., 4 Jun 2026). The paper presents the method as a four-stage pipeline.

In Stage I – Slot Probing, given a prompt $0$2, the method forms a probing prompt by inserting a single unique probe token $0$3 at each slot $0$4. One forward pass is then used to extract attention weights $0$5, after which $0$6 is computed for all slots.

In Stage II – Slot Selection Probability, the set of VSS values is converted into a slot-selection distribution $0$7 over $0$8 using a softmax with temperature $0$9: $x_1$0 This produces a probabilistic allocation rule rather than a hard top-$x_1$1 choice.

In Stage III – Token Allocation, a total token budget $x_1$2 is distributed across slots. For each slot $x_1$3,

$x_1$4

The method assigns

$x_1$5

such that $x_1$6, giving the largest extra tokens to the top slots by fractional part $x_1$7. The initial adversarial prompt is then assembled by inserting $x_1$8 placeholder tokens at each selected slot in right-to-left order.

In Stage IV – Targeted Optimization (GCG-style), the insertion slots

$x_1$9

are frozen, and Greedy Coordinate Gradient, or any discrete gradient search, is applied over the concatenated adversarial tokens $s$0 to minimize

$s$1

Optimization stops when the model emits a harmful response or after a fixed iteration budget $s$2.

The algorithmic design is notable because it decouples where adversarial tokens should be placed from what those tokens should be. This suggests a modular view of jailbreak optimization in which position search is attack-agnostic and discrete token search remains the downstream subroutine.

4. Compatibility, implementation, and computational profile

The implementation is designed as a wrapper around existing GCG-style methods rather than as a replacement for them (Jeong et al., 4 Jun 2026). The slot-probing forward pass adds only $s$3 ms per prompt on an A100 GPU, and all remaining steps reuse the same gradient queries as standard GCG, so the total overhead is described as negligible compared to the thousands of tokens-of-gradient calls used by baseline optimization.

The framework is explicitly presented as attack-agnostic. The paper states that SlotGCG can wrap around any GCG-style subroutine—AttnGCG, I-GCG, GCG-Hij, and GBDA—simply by replacing fixed suffix insertion with multi-slot allocation. This modularity is one of the paper’s main claims: slot discovery is treated as a general front-end for discrete optimization jailbreaks rather than a method tied to one specific optimizer.

The implementation is available at the repository listed in the paper: https://github.com/youai058/SlotGCG. From a systems perspective, the method’s main practical requirement is access to internal attention weights, since VSS is computed directly from those weights. This makes the framework naturally aligned with white-box settings.

5. Experimental setting and quantitative results

The experimental evaluation uses multiple open-weight chat and instruction models: Llama-2-7B-Chat, Llama-2-13B-Chat, Llama-3.1-8B-Instruct, Mistral-7B, Vicuna-7B, and Qwen-2.5 (Jeong et al., 4 Jun 2026). Baseline attacks are GCG, AttnGCG, I-GCG, GCG-Hij, and GBDA. Defenses include Erase-and-Check (suffix/infusion), Perplexity filter, SmoothLLM (swap/insert/patch), RPO, SafeDecoding, and Llama-Guard-3. The dataset consists of 50 harmful prompts drawn from AdvBench. ASR is measured by a pipeline of keyword filter, GPT-4 judge, and human verification, while convergence speed is measured by average iterations to success.

The core reported gains are summarized below.

Attack	Baseline ASR	SlotGCG ASR
GCG	~66.7%	~80.0%
AttnGCG	61.7%	86.3%
I-GCG	73.0%	85.7%
GCG-Hij	78.0%	84.3%
GBDA	20.3%	40.0%

Across models, the corresponding improvements are reported as $s$4 percentage points for GCG, $s$5 for AttnGCG, $s$6 for I-GCG, $s$7 for GCG-Hij, and $s$8 for GBDA (Jeong et al., 4 Jun 2026). The abstract states this result more generally as 14% higher Attack Success Rates over GCG-based attacks.

Under input-filter defenses, the average ASR across the four GCG variants rises from approximately 18–26% to approximately 46–54%, a net gain of 23–33 percentage points, described as roughly +42% relative. In convergence terms, the mean iterations to success for GCG fall from approximately 72.6 to 28.6, a reduction of 44 steps, with similar 2–10× speedups reported for the other baselines. The paper’s ablation on temperature reports that $s$9 is best, balancing concentration versus diversity; too low a temperature over-concentrates slots, while too high a temperature scatters tokens.

These results are significant because they isolate a variable—prompt position—that had largely been fixed by design in many prior optimization-based jailbreak attacks. The empirical pattern suggests that multi-slot adversarial placement can improve both sample efficiency and defense robustness without changing the underlying gradient-based token optimizer.

6. Strengths, limitations, misconceptions, and extensions

The paper identifies three principal strengths for SlotGCG (Jeong et al., 4 Jun 2026). First, it is general: an attack-agnostic slot-discovery mechanism that plugs into any discrete-optimization jailbreak. Second, it is efficient: it requires only a single extra forward pass per prompt for slot probing. Third, it is robust: the summarized gains include 14 percentage points higher ASR and 2–5× faster convergence, while still retaining +30–40 percentage points headroom under major defenses.

Two limitations are stated directly. The first is the white-box requisite: access to attention weights is required, and black-box estimation would require additional queries. The second is static allocation: adversarial tokens are pre-allocated by slot and then jointly optimized, which could miss dynamic slot shifts during optimization. These are not incidental constraints; they define the method’s present applicability and separate it from purely black-box jailbreak procedures.

A common misconception is that SlotGCG is merely a better suffix attack. The method is instead built on the claim that fixed suffix insertion is itself a restriction, and that vulnerability is highly related to slot selection. Another misconception is that VSS is a post hoc artifact of successful attacks. The reported Pearson correlation between VSS at initialization and at the end of optimization is presented precisely to argue against that interpretation.

The paper also sketches several extensions. These include black-box approximation of VSS via attention-proxy models or surrogate gradients, dynamic slot re-estimation every $1 \le s \le L-1$0 iterations to track evolving token interactions, and Universal SlotGCG, described in Appendix E as a multi-behavior curriculum approach for computing a single slot-aware adversarial suffix transferable across many behaviors. These directions remain proposals rather than evaluated components in the main reported system.

Taken together, SlotGCG reframes jailbreak optimization around positional vulnerability. Its main contribution is not a new discrete optimizer but a method for scoring, selecting, and exploiting the prompt locations that are most exposed to adversarial influence. In that sense, the framework broadens the attack model from “optimize the suffix” to “optimize the placement of optimization itself” (Jeong et al., 4 Jun 2026).