# Probabilistic Adversarial Attack

The work reformulates LLM-agent jailbreaking probabilistically: it shows that the gradient of the log expected harmfulness with respect to the input equals the expected log-likelihood gradient under a harmfulness-reweighted output distribution, unifying expected-harmfulness maximization with target-likelihood optimization; building on this, OPUR constructs surrogate targets from the model's own stochastic rollouts to guide adversarial suffix optimization, achieving higher targeted attack success rates on AgentHarm, InjecAgent, and WebShop.

The work reformulates LLM-agent jailbreaking probabilistically: it shows that the gradient of the log expected harmfulness with respect to the input equals the expected log-likelihood gradient under a harmfulness-reweighted output distribution, unifying expected-harmfulness maximization with target-likelihood optimization; building on this, OPUR constructs surrogate targets from the model's own stochastic rollouts to guide adversarial suffix optimization, achieving higher targeted attack success rates on AgentHarm, InjecAgent, and WebShop.