SAGE Self-Check Jailbreak Defense Breached by Code Encoding and Best-of-N Search

A recent study reveals that SAGE, a self-check jailbreak protection for large language models boasting a 99% success rate in defense, can be bypassed by merging two seemingly innocuous attacks: a code-completion encoding and a best-of-N search. Individually, these attacks yield success rates below 4.7%. However, when combined with a search budget applied to the encoding, they achieve success rates of 67%, 22%, and 15% across three open targets, with effects observed on a model with 70 billion parameters. The findings indicate that SAGE relies on the target model for its effectiveness, as it does not detect attacks but rather prompts the model to evaluate requests, resulting in explicit refusals between 32% and 97% of the time. The study also highlights which attack endures the combination, shedding light on the weaknesses of self-check systems.