Controlled Decoding Attacks on Black-Box LLMs
The paper says jailbreak control can be rebuilt from sampled text alone, without weights or token probabilities.
Its method targets black-box continuation interfaces that allow repeated sampling and assistant-prefix continuation. It reconstructs a usable distribution signal from sampled outputs, then spends extra queries only at positions judged risky along the response. A speculative execution step accepts draft prefixes when no intervention is needed, cutting target calls. Across four endpoints and three benchmarks, the authors report the method leading most baseline comparisons. HF Daily Papers' note
Its method targets black-box continuation interfaces that allow repeated sampling and assistant-prefix continuation. It reconstructs a usable distribution signal from sampled outputs, then spends extra queries only at positions judged risky along the response. A speculative execution step accepts draft prefixes when no intervention is needed, cutting target calls. Across four endpoints and three benchmarks, the authors report the method leading most baseline comparisons. HF Daily Papers' note
score 4