Yangchen Pan, Amir-Massoud Farahmand, Avery Ma
We lifted 1 functions out of this paper's own repositories and ran 1 of them in a sandbox. "Ran" means the function executed on a synthesized input and returned a value. It is not a reproduction of the paper's results.
| Repository | Role | Ran |
|---|---|---|
| averyma/pandas | canonical | 1 of 1 |
| Function | Status | Where it lives |
|---|---|---|
| load_checkpoint | Ran | averyma/pandas/main_jailbreak.py pointer only (licence: NONE) · get_code("0a9d5638eda7e380") |
Some links come from the archived Papers with Code dataset (CC BY-SA 4.0): attribution and licence.
Many-shot jailbreaking circumvents the safety alignment of LLMs by exploiting their ability to process long input sequences. To achieve this, the malicious target prompt is prefixed with hundreds of fabricated conversational exchanges between the user and the model. These exchanges are randomly sampled from a pool of unsafe question-answer pairs, making it appear as though the model has already complied with harmful instructions. In this paper, we present PANDAS: a hybrid technique that improves many-shot jailbreaking by modifying these fabricated dialogues with Positive Affirmations, Negative Demonstrations, and an optimized Adaptive Sampling method tailored to the target prompt's topic. We also introduce ManyHarm, a dataset of harmful question-answer pairs, and demonstrate through extensive experiments that PANDAS significantly outperforms baseline methods in long-context scenarios. Through attention analysis, we provide insights into how long-context vulnerabilities are exploited and show how PANDAS further improves upon manyshot jailbreaking. Our source code is available at https://github.com/averyma/pandas. Warning: This paper contains model behavior that can be offensive or harmful in nature.
The same record, over MCP at https://syntology.ai/mcp:
get_harvested_code_for_paper("2502.01925")
get_code_for_paper("2502.01925")
have("2502.01925")
Connect an agent — have() is free.