Mask-GCG: Are All Tokens in Adversarial Suffixes Necessary for Jailbreak Attacks?

Jailbreak attacks manipulate Large Language Models to generate harmful responses they are designed to avoid. Greedy Coordinate Gradient (GCG) has emerged as a general and effective approach that optimizes tokens in a suffix to generate jailbreakable prompts. However, GCG and its variants rely on fixed-length suffixes, and potential redundancy within these suffixes remains unexplored. We propose Mask-GCG, a plug-and-play method employing learnable token masking to identify impactful tokens within the suffix. Our approach increases update probability for high-impact tokens while pruning low-impact ones. This reduces redundancy, decreases gradient space size, and lowers computational overhead, shortening attack time. We evaluate Mask-GCG by applying it to the GCG and several improved variants. Experimental results show that most tokens in the suffix contribute significantly to attack success, and pruning a minority of low-impact tokens does not affect the loss values or compromise the attack success rate (ASR), thereby revealing token redundancy in LLM prompts. Our findings provide insights for developing efficient and interpretable LLMs from the perspective of jailbreak attacks.