Untargeted Jailbreak Attack (UJA) Overview

• UJA is defined as an attack method that maximizes the probability of any harmful, policy-violating output rather than a predetermined harmful response.
• It leverages diverse strategies including prompt engineering, representation space optimization, and cross-model orchestration to amplify attack success across different systems.
• Empirical studies report high attack success rates and widespread vulnerabilities, emphasizing the need for robust, ecosystem-level safety defenses.

Searching arXiv for the main papers on untargeted jailbreak attacks and closely related jailbreak frameworks. Search query: "Untargeted Jailbreak Attack arXiv (Huang et al., 3 Oct 2025, Xiang et al., 16 May 2026, He et al., 11 May 2026, Wang et al., 15 Jun 2026)" Untargeted Jailbreak Attack (UJA) denotes a jailbreak attack whose objective is to make a model produce some harmful output, without caring exactly which harmful content is produced. In this formulation, success is defined by policy violation rather than by matching a predetermined string or response prefix. Recent work treats this objective as central rather than incidental: text-only attacks optimize unsafety directly instead of aiming at a fixed target response (Huang et al., 3 Oct 2025), multimodal attacks relax fixed-prefix constraints to improve transferability (He et al., 11 May 2026), and pool-level attacks redefine success as compromising any model in a queried group rather than a single target (Xiang et al., 16 May 2026). Across LLMs, VLMs, LALMs, and diffusion-based image systems, UJA has therefore become a unifying lens for attacks that target safety failure as a behavior class.

1. Definition and conceptual boundaries

An untargeted jailbreak attack is any attack whose goal is to make a model produce some harmful output, without caring exactly which harmful content is produced (Xiang et al., 16 May 2026). This differs from targeted jailbreak objectives that force a specific harmful output, a fixed prefix, or a tightly constrained response pattern. The paper "Untargeted Jailbreak Attack" argues that targeted gradient-based jailbreaks such as GCG and COLD-Attack restrict the optimization objective by inducing a predefined target, which constrains the adversarial search space and lowers attack efficiency (Huang et al., 3 Oct 2025). In contrast, the untargeted objective maximizes the probability that the model violates safety policy in any acceptable way.

This distinction is explicit in several automated prompt-space frameworks. "Automated jailbreak attack targeting multiple defense strategies" defines UniAttack as untargeted with respect to the model’s specific output content because success requires any harmful, policy-violating output rather than an exact string (Wang et al., 15 Jun 2026). "StructuralSleight: Automated Jailbreak Attacks on LLMs Utilizing Uncommon Text-Organization Structures" is likewise explicitly untargeted: any response that substantially violates safety norms counts as success, and the framework maximizes ASR rather than matching a predetermined output (Li et al., 2024). "Activation-Guided Local Editing for Jailbreaking Attacks" also treats attack success as harmful content relevant to the malicious query, not a specific target answer, and therefore fits the semantics of UJA (Wang et al., 1 Aug 2025).

The boundary is less clean in some multimodal settings. "AudioJailbreak: Jailbreak Attacks against End-to-End Large Audio-LLMs" optimizes toward a fixed harmful or affirmative prefix such as “Sure, here is a tutorial on how to make a bomb,” so it is targeted at the algorithmic level, but the paper also states that its security semantics are much closer to an untargeted jailbreak because the real goal is broad safety violation across many prompts and users (Chen et al., 20 May 2025). This suggests that UJA is best understood not only as a narrow optimization label but also as a behavior-level threat model.

2. Formalization and evaluation criteria

The standard single-model metric is Attack Success Rate: $\text{ASR} = \frac{1}{N} \sum_{n=1}^N s_n,$ where $s_n \in \{0,1\}$ indicates whether the $n$-th harmful intent successfully jailbreaks the model (Xiang et al., 16 May 2026). In UJA, $s_n=1$ means that the response is judged harmful; there is no requirement to match a target string.

The paper "Untargeted Jailbreak Attack" formalizes the untargeted objective directly as maximizing the unsafety probability of the LLM response: $\max_{p} \mathcal{J}(L(p)),$ where $L$ is the target LLM, $p$ is the optimized prompt, and $\mathcal{J}$ is a judge model that outputs the probability that the response is unsafe (Huang et al., 3 Oct 2025). This formulation replaces fixed-prefix cross-entropy objectives with a judge-defined unsafety objective and thereby enlarges the search space.

When the attacker can query a group of models, the relevant pool-level metric is Wide-net-casting Attack Success Rate: $$\text{WASR} = \frac{1}{N} \sum_{n=1}^{N} \bigvee_{m=1}^{M} s_{n,m},$$ where $s_{n,m}$ indicates whether intent $s_n \in \{0,1\}$0 jailbreaks model $s_n \in \{0,1\}$1 (Xiang et al., 16 May 2026). For UJA, this is the natural “at least one harmful response” metric. The same work also defines a Wide-net-casting Toxicity Score in which an LLM selects the response “most likely to be used for harm,” and a toxicity classifier scores that worst-case response (Xiang et al., 16 May 2026).

A closely related multimodal formalization appears in "Break the Brake, Not the Wheel: Untargeted Jailbreak via Entropy Maximization." There, jailbreak succeeds if any response generated on the adversarial image is judged unsafe by external evaluators, with no requirement that the response contain a particular string, prefix, or pattern (He et al., 11 May 2026). The attack therefore targets the refusal-to-non-refusal transition itself rather than a fixed completion.

3. Principal methodological families

The current UJA literature spans prompt engineering, optimization in representation space, cross-model orchestration, and model-side compromise. The following families recur across recent work.

Family	Core mechanism	Representative papers
Feature-centric black-box attacks	Extract minimal but high-impact attack features and fuse them into one-shot templates	UniAttack (Wang et al., 15 Jun 2026)
Structure-level prompt attacks	Use uncommon text-organization structures plus obfuscation	StructuralSleight (Li et al., 2024)
Untargeted optimization	Maximize unsafety or refusal entropy instead of a fixed target prefix	UJA (Huang et al., 3 Oct 2025); UJEM-KL (He et al., 11 May 2026)
Representation-guided local editing	Shift hidden states from malicious toward benign regions while preserving malicious intent	AGILE (Wang et al., 1 Aug 2025)
Tool-assisted compositional search	Compose atomic jailbreak tools and learn tool selection across episodes	JailbreakOPT (Shi et al., 9 Jun 2026)
Backdoor or context manipulation	Inject universal triggers or exploit virtual assistant context	JailbreakEdit (Chen et al., 9 Feb 2025); Virtual Context (Zhou et al., 2024); CAIR (Wu et al., 2024)

Feature-centric attacks such as UniAttack mine heterogeneous jailbreak methods for “minimal but high-impact attack features,” validate them, and then compose them into flexible templates that generalize across models and defense layers (Wang et al., 15 Jun 2026). Structure-level attacks such as StructuralSleight instead treat prompt organization itself as the attack surface, using Uncommon Text-Encoded Structures such as graphs, JSON, XML, Python classes, and LaTeX tables to induce mismatched safety generalization (Li et al., 2024).

Optimization-based UJA work moves further away from fixed textual targets. The paper "Untargeted Jailbreak Attack" decomposes unsafety maximization into optimization of an “optimal harmful response” and optimization of a prompt whose response representation approaches that harmful response in hidden space (Huang et al., 3 Oct 2025). UJEM-KL identifies high-entropy “decision tokens” at which refusal behavior concentrates and then maximizes entropy there while stabilizing low-entropy structural positions with KL regularization (He et al., 11 May 2026). AGILE uses small MLP classifiers over hidden states to guide synonym substitution and token injection, with the explicit aim of lowering refusal likelihood and moving activations from a malicious region toward a benign region (Wang et al., 1 Aug 2025).

Other UJA families target the broader system rather than the prompt alone. JailbreakOPT treats atomic jailbreak prompts as tools, composes them through encode–decode chains, and learns tool selection as a contextual bandit problem via contextual Thompson sampling (Shi et al., 9 Jun 2026). JailbreakEdit injects a universal jailbreak backdoor into a safety-aligned LLM through a rank-one model edit that creates a shortcut from a rare trigger token to an estimated “jailbreak space” (Chen et al., 9 Feb 2025). Virtual Context exploits a user-inserted separator token so that part of the prompt is treated as if it were already the assistant’s own reply, biasing continuation toward harmful compliance (Zhou et al., 2024). CAIR decomposes a malicious request into benign-appearing structural elements and later reconstructs the harmful instruction through implicit reference within conversation context (Wu et al., 2024).

4. Operational settings and modalities

The UJA threat model is no longer confined to a single text-only model. "New Wide-Net-Casting Jailbreak Attacks Risk Large Models" introduces the wide-net-casting scenario in which the attacker queries a group of models and counts the attack as successful if any one of them produces a harmful response (Xiang et al., 16 May 2026). This reframes UJA from single-model robustness to ecosystem-level robustness. The same paper argues that the pool-level success probability grows rapidly with the number of models under independence assumptions, and it further proposes a model-based joint training method that specializes one adversarial generator per model and explicitly maximizes group-level WASR (Xiang et al., 16 May 2026).

In multimodal systems, UJA takes modality-specific forms. UJEM-KL attacks VLMs by perturbing only the image under an $s_n \in \{0,1\}$2 budget of $s_n \in \{0,1\}$3, while keeping the textual instruction fixed, and defines success purely in terms of any unsafe non-refusal answer judged by external classifiers (He et al., 11 May 2026). AudioJailbreak shows that text jailbreaks ported through text-to-speech are ineffective on end-to-end LALMs on average, which motivates direct audio attacks with suffixal jailbreak audio, universal perturbations, intent concealment, and room-impulse-response robustness (Chen et al., 20 May 2025). In diffusion-based image models, Antelope is formally targeted at a sensitive attribute type such as nudity or violence, but its use of semantically adjacent concepts and benign-looking suffixes suggests a broader template for policy-violation search in text-to-image systems (Zhao et al., 2024).

The operational surface also includes conversational and cross-model settings. CAIR exploits multi-turn context and implicit reference rather than stateless prompts (Wu et al., 2024). J2 constructs a red-teaming attacker by jailbreaking an LLM into a helper persona that can then attack other models, including a copy of itself, in a purely black-box manner (Kritz et al., 9 Feb 2025). This suggests that UJA increasingly spans not only prompt optimization but also attacker-side orchestration, context management, and cross-model delegation.

5. Empirical performance and mechanistic findings

Recent work reports very high attack success rates for untargeted or effectively untargeted jailbreaks. StructuralSleight-SCA reaches 94.62% ASR on GPT-4o, 96.00% on Claude2.0, 92.00% on Llama3-70B, and 82.31% on Claude3-Opus, all with single prompts per harmful behavior (Li et al., 2024). UniAttack reports an average ASR of 87.17% across 9 target models and achieves 64.63%–248.82% relative improvement in ASR compared to its baselines while using only 0.03%–4.96% of their token cost (Wang et al., 15 Jun 2026). AGILE reports gains of up to 37.74% over the strongest baseline and strong transfer to black-box targets (Wang et al., 1 Aug 2025). Virtual Context raises the average ASR of direct malicious prompts from 1.15% to 54.62% across five models and improves the ASR of four widely used jailbreak methods by approximately 40% on average (Zhou et al., 2024).

Pool-level amplification is especially severe. In wide-net-casting, adapting GCG to four LLMs on AdvBench yields a best single-model ASR of 46.2% on Mistral-7b but a group WASR of 75.0%; adapting ReMiss pushes group WASR to 92.3%; and the paper’s tailored joint-training method reaches 100% in some LLM and MLLM settings without additional safeguards (Xiang et al., 16 May 2026). "Universal Jailbreak Suffixes Are Strong Attention Hijackers" explains a related phenomenon mechanistically: GCG suffixes become strong attention hijackers, dominating the information flow from adversarial suffix tokens to the final chat-template tokens before generation, and more universal suffixes are stronger hijackers (Ben-Tov et al., 15 Jun 2025). That paper further shows that universality can be enhanced up to $s_n \in \{0,1\}$4 in some cases at no additional computational cost and that hijacking suppression can at least halve attack success with minimal utility loss (Ben-Tov et al., 15 Jun 2025).

In multimodal systems, UJEM-KL achieves white-box ASRs of 82.23%, 83.67%, and 88.32% on JailBreakV-28K for Qwen2.5-VL-7B-Instruct, InternVL3.5-4B, and LLaVA-1.5-7B respectively, while also improving cross-model transferability over prior optimization-based baselines (He et al., 11 May 2026). AudioJailbreak reports that advanced text jailbreaks ported via TTS achieve on average 42.7% ASR on text LLMs but only 9.1% ASR on end-to-end LALMs, whereas its own universal weak-adversary suffixes achieve at least 76% ASR across LALMs and retain about 70% ASR$s_n \in \{0,1\}$5 over the air with room-impulse-response training on Qwen-Audio (Chen et al., 20 May 2025). Antelope attains 81.98% ASR on SDv1.4 and 57.96% on SDv2.1 for nudity, with best or near-best FID across several defenses, and also transfers to Midjourney and Leonardo.ai in black-box settings (Zhao et al., 2024).

Attacker-side orchestration can itself become a UJA multiplier. J2 reports that prompts used to create $s_n \in \{0,1\}$6 attackers transfer across almost all black-box models, that a $s_n \in \{0,1\}$7 attacker can jailbreak a copy of itself, and that reasoning models are particularly strong red-teamers (Kritz et al., 9 Feb 2025). The paper reports that $s_n \in \{0,1\}$8 built from Sonnet-3.7 achieves 0.975 ASR against GPT-4o, matching expert human red teamers and surpassing state-of-the-art algorithm-based attacks, while $s_n \in \{0,1\}$9 built from o3 achieves 0.605 ASR against Sonnet-3.5 (Kritz et al., 9 Feb 2025).

6. Defenses, misconceptions, and unresolved issues

A recurrent misconception is that low single-model ASR is sufficient. Wide-net-casting directly contradicts this: even if each model is individually “acceptable,” querying a pool can push the probability of at least one harmful response very high, including for same-family variants and under additional safeguards such as SmoothLLM, RobustKV, VLGuard, IMMUNE, and ASTRA (Xiang et al., 16 May 2026). This suggests that UJA defense must be evaluated at the ecosystem level rather than at the isolated-model level.

A second misconception is that untargeted jailbreaks are merely crude prompt hacks. Several works indicate the opposite. UJEM-KL shows that refusal behavior concentrates at high-entropy decision tokens and that untargeted multimodal optimization can exploit this structure without any fixed harmful prefix (He et al., 11 May 2026). AGILE shows that successful jailbreaks can be interpreted as moving hidden states into a benign-looking region while preserving malicious intent at the semantic level (Wang et al., 1 Aug 2025). CAIR reports an inverse scaling phenomenon in which larger models are more vulnerable to contextual implicit-reference attacks because stronger in-context reasoning also improves recovery of hidden malicious objectives (Wu et al., 2024).

Defensive proposals correspondingly shift from pattern blocking to representation-aware control. UniAttack argues for reasoning-aware, chain-of-thought integrated defenses that perform objective extraction, adversarial intent auditing, and output-in-the-loop reflection rather than relying only on separate filters (Wang et al., 15 Jun 2026). AutoDefense combines pre-generative and post-generative defenses in a mixture-of-defenders framework and uses AutoEvaluation to distinguish jailbreak success, hallucination, and alignment, reducing JR to near zero in several reported settings (Lu et al., 2024). "Universal Jailbreak Suffixes Are Strong Attention Hijackers" proposes Hijacking Suppression, which scales down the top 1% most hijacking-prone transformed vectors from input tokens to chat tokens; on Gemma2 this reduces jailbreak success from 60.02% to 9.32% with small utility loss on AlpacaEval and MMLU (Ben-Tov et al., 15 Jun 2025). Virtual Context implies that sanitizing user-supplied special tokens is necessary because a user-inserted separator token can fabricate virtual assistant history (Zhou et al., 2024). JailbreakEdit, in turn, implies that model integrity verification matters because a universal jailbreak backdoor can be injected via a localized rank-one edit while preserving benign performance (Chen et al., 9 Feb 2025).

The most persistent unresolved issue is scope. UJA now spans single-turn prompt attacks, pool-level attacks, multi-turn contextual attacks, multimodal perturbations, tool-assisted search, and model-editing backdoors. This suggests that “jailbreak robustness” is not a single property but a family of robustness requirements over prompts, contexts, modalities, model pools, and even attacker-side models. Current evaluation increasingly reflects that shift, but the literature also indicates that defense research has not yet closed the gap.