Greedy Coordinate Gradients (GCG)
Greedy Coordinate Gradients (GCG) is an automated white-box adversarial attack that uses token-level gradient backpropagation to search for universal adversarial suffixes (e.g. '! ! ! describe step-by-step'). When appended to a harmful query, the suffix minimizes the cross-entropy loss of producing an affirmative compliance prefix ('Sure, here is...'), bypassing safety filters.
First-Order Token Gradients
Because token sequences are discrete, standard continuous gradients cannot directly update text. GCG computes the gradient of the loss with respect to one-hot token embeddings, identifying the top-k candidate token substitutions at each position.
Greedy Batch Evaluation
Out of the top candidate token substitutions, GCG evaluates the exact forward loss on a batch of candidate suffixes and greedily chooses the substitution that minimizes the target generation loss.
Cross-Model Universal Transferability
Adversarial suffixes optimized simultaneously on multiple open-source models (e.g., Llama and Vicuna) frequently transfer successfully to closed proprietary models (e.g., GPT-4 or Claude), demonstrating shared latent geometric vulnerabilities.
Where x is the harmful instruction, S is the candidate discrete token suffix, and y_target is the affirmative prefix (e.g., 'Sure, here is how to create...'). Gradients nabla_e_i L identify the most effective token swaps.
- Deploy token perplexity filters: GCG suffixes typically have extremely high token perplexity compared to natural language prompts.
- Use SmoothLLM: apply random character perturbations (insertions, deletions, swaps) to the prompt; adversarial suffixes are brittle and fail when perturbed.
- Incorporate adversarial suffixes directly into the negative preference dataset during DPO/RLHF alignment.