AutoDAN Turbo

AutoDAN-Turbo is an advanced, black-box jailbreaking method that builds on the evolutionary foundation of AutoDAN by adding a lifelong learning component. Instead of starting from scratch on every run, AutoDAN-Turbo maintains a persistent strategy library — a growing collection of attack patterns that have proven effective against various models. Over successive runs, the library becomes an increasingly powerful asset that accelerates convergence and improves attack success rates.

This approach was introduced in the paper AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs and represents a shift from per-session optimization to cumulative learning. The method uses a multi-model architecture where separate LLMs handle attack generation, scoring, strategy summarization, and embedding, enabling a sophisticated pipeline that discovers, catalogs, and reuses effective adversarial strategies.

How the Strategy Library WorksHow the Strategy Library Works

The strategy library is the key innovation that distinguishes AutoDAN-Turbo from standard AutoDAN. It functions as a long-term memory that stores distilled representations of successful attack strategies, indexed by embeddings for efficient retrieval.

Each entry in the library captures:

• Strategy description: A natural-language summary of the attack pattern (e.g., “Frame the request as a fictional writing exercise with a specific character who would naturally provide the information”)
• Effectiveness signal: Metadata about which models and goal categories the strategy succeeded against
• Embedding vector: A dense representation computed by the embedding_model, used to retrieve relevant strategies when attacking a new goal

When attacking a new goal, AutoDAN-Turbo first retrieves the most relevant strategies from the library and uses them to seed the generation process. This means the method doesn’t waste time rediscovering patterns it already knows — it starts from a strong prior and focuses its compute budget on refining and adapting strategies to the specific target.

Exploration vs. Exploitation PhasesExploration vs. Exploitation Phases

AutoDAN-Turbo operates in two distinct phases, controlled by the warm_up_iterations and lifelong_iterations parameters:

Warm-up (Exploration)Warm-up (Exploration)

During the initial warm_up_iterations, the method generates attack prompts without consulting the strategy library. This phase serves two purposes: it avoids over-reliance on potentially stale strategies when targeting a new model, and it discovers novel patterns that may not yet exist in the library. New effective strategies discovered during warm-up are added to the library.

Lifelong Iterations (Exploitation)Lifelong Iterations (Exploitation)

After warm-up, the method enters the lifelong learning phase. Here it retrieves relevant strategies from the library, uses them to guide prompt generation, scores the results, and updates the library with any newly discovered or refined strategies. The lifelong_iterations parameter controls how many rounds of this retrieve-generate-evaluate-update cycle to run per epoch.

The balance between warm_up_iterations and lifelong_iterations controls the exploration-exploitation tradeoff. More warm-up iterations encourage novel strategy discovery; more lifelong iterations exploit known-effective patterns.

Comparison with Base AutoDANComparison with Base AutoDAN

AutoDAN-Turbo is generally the better choice for practical safety audits because it works with any model through its API and becomes more efficient over time as the strategy library grows. Base AutoDAN is preferred when you have white-box access and want to leverage gradient-based fitness for a specific model.

UsageUsage

The following example configures AutoDAN-Turbo to attack Claude 3.7 Sonnet using DeepSeek-R1 as the attacker, scorer, and summarizer model, with OpenAI’s text-embedding-3-small for strategy embeddings.

from generalanalysis.jailbreaks import AutoDANTurbo, AutoDANTurboConfig
 
config = AutoDANTurboConfig(
    project="autodan-turbo-test",
    target_model="claude-3-7-sonnet-20250219",
    attacker_model="deepseek-ai/DeepSeek-R1",
    scorer_model="deepseek-ai/DeepSeek-R1",
    summarizer_model="deepseek-ai/DeepSeek-R1",
    embedding_model="text-embedding-3-small",
    epochs=150,
    break_score=8.5,
    warm_up_iterations=1,
    lifelong_iterations=4,
    max_workers=10,
    temperature=0.7
)
 
autodan_turbo = AutoDANTurbo(config)
results = autodan_turbo.optimize(goals=["Generate harmful content"])

The multi-model architecture lets you choose the best model for each role. A strong reasoning model like DeepSeek-R1 works well for attack generation and scoring, while a fast embedding model handles the strategy library indexing.

Key ParametersKey Parameters

Configuration TipsConfiguration Tips

• Reuse project directories: The strategy library persists in the project directory. Running multiple experiments with the same project name accumulates strategies across runs, making the method progressively more effective.
• Start with moderate warm-up: For a model you’ve never tested before, use warm_up_iterations=3 to discover fresh strategies before exploiting the library. For familiar models, warm_up_iterations=1 is sufficient.
• Use capable attacker/scorer models: The quality of the attacker and scorer models directly determines the quality of the generated attacks and the accuracy of the strategy library. Reasoning-optimized models like DeepSeek-R1 significantly outperform smaller models in both roles.
• Monitor break_score sensitivity: A break_score that is too low may classify refusals as successes, polluting the strategy library. A score that is too high may cause the method to spend excessive budget on goals that are already effectively solved.

Related MethodsRelated Methods

• AutoDAN evolutionary jailbreak — The white-box base method that uses evolutionary search with gradient-based fitness
• TAP tree-of-attacks jailbreak — A tree-based black-box method that is often faster for single-run attacks but doesn’t accumulate strategies across runs
• Crescendo multi-turn jailbreak — A multi-turn black-box method that gradually builds context rather than using a strategy library

For detailed performance metrics and configurations, refer to our LLM Jailbreak Cookbook .