claudini/claudini/methods/original/rails

name, full_name, reference, paper_url

name	full_name	reference	paper_url
RAILS	RAndom Iterative Local Search	nurlanov2026jailbreaking	https://arxiv.org/abs/2601.03420

RAILS — RAndom Iterative Local Search

Paper: Nurlanov et al., "Jailbreaking LLMs Without Gradients or Priors: Effective and Transferable Attacks" (2026) Links: arXiv \cite{nurlanov2026jailbreaking}

No public code repository. Implementation based on the paper and supplementary code provided by the authors.

Algorithm

Gradient-free token optimization with two key innovations over PRS:

1. Auto-regressive loss (L_AR): Teacher-forcing loss where the prefix is correctly predicted by greedy argmax; constant penalty C for all positions after the first mismatch. Forces exact prefix matching before optimizing later tokens.
2. Combined loss: alpha * L_AR + (1 - alpha) * L_TF, where L_TF is standard teacher-forcing CE.

Each step generates num_candidates mutations by replacing a single random token, evaluates all candidates with the combined loss in a batched forward pass, and keeps the best (greedy update). Patience-based restarts reinitialize the suffix if no improvement is found.

The original paper also includes a history-based selection strategy (hybrid exploit/explore from the candidate history buffer) and a few-shot validation phase, which are specific to the jailbreaking evaluation protocol and not part of the core optimization loop.

Key Hyperparameters

• num_candidates: candidates per step (default: 1024)
• alpha: weight on L_AR in combined loss (default: 0.9)
• ar_penalty: constant C for prefix-mismatch penalty (default: 100.0)
• patience: steps without improvement before restart (default: 50)