1. The technique contribution is week. The proposed method utilizes the LLM to refine the prompt. Thus, the performance of the proposed method heavily relies on the designed system prompt and LLMs. Moreover, the proposed method is based on heuristics, i.e., there is no insight for the proposed approach. But I understand those two points could be very challenging for LLM research.
2. The evaluation is not systematic. For instance, only 50 questions are used in the evaluation. Thus, it is unclear whether the proposed approach is generalizable. More importantly, is the judge model the same for the proposed algorithm and evaluation? If this is the case, it is hard to see whether the reported results are reliable as LLMs could be inaccurate in their predictions. It would be better if other metrics could be used for cross-validation, e.g., manually check and the word list used by Zou et al. 2023. The proposed method is only compared with GCG. There are also many other baselines, e.g., handcrafted methods (https://www.jailbreakchat.com/).
3. In GCG, authors showed that their approach could be transferred to other LLMs. Thus, GCG could craft adversarial prompts and transfer them to other LLMs. It would be good if such a comparison could be included.
A minor point: The jailbreaking percentage is low for certain LLMs.
3. In GCG, authors showed that their approach could be transferred to other LLMs. Thus, GCG could craft adversarial prompts and transfer them to other LLMs. It would be good if such a comparison could be included. A minor point: The jailbreaking percentage is low for certain LLMs.