Single suffix jailbreak spans merged LLM families

Problem

This paper studies safety risks introduced by parameter merging of fine-tuned large language models. Prior work has focused on unsafe constituent models contaminating merges, implicitly assuming that merging aligned models preserves safety. The authors show an alternative risk: merged models that share the same pretrained backbone can expose shared vulnerable directions originating in the backbone itself, allowing a single adversarial suffix to jailbreak many different merged variants even when each constituent model is individually safety aligned. This matters because model merging is widely used to combine capabilities without retraining, expanding the attack surface beyond individual checkpoints.

Approach

The authors define a threat model in which an attacker knows the pretrained backbone but not the exact set of fine-tuned models, merging coefficients, or merge algorithm used for a deployed model. They propose Basin-Aware Jailbreak (BAJ), which frames suffix generation as a min max optimisation over the merging space to find suffixes that remain effective across a connected low-loss basin of merged models. Practically, merged models are parameterised via task arithmetic so the basin is explored by varying merging coefficients. BAJ alternates between (1) optimising a discrete adversarial suffix with a mutation-based evolutionary search guided by a lightweight linear probe on last-layer representations and (2) maximising over merging coefficients using gradient ascent to find the most resistant merged surrogate. Evaluation uses several pretrained backbones, five task-specific fine-tunes per backbone to produce many merged combinations, and transfer success rate as the main metric. Attack success is measured by an LLM classifier judge and supported by human annotation.

Key Findings

• BAJ produces adversarial suffixes that transfer reliably across merged model families sharing the same backbone, achieving consistently high transfer success rates across evaluated backbones and merge methods.
• The vulnerability cannot be explained by unsafe constituent models: merged models and individual fine-tuned models showed near-zero baseline attack success on harmful requests without BAJ, indicating the issue stems from merged-model families rather than obvious misaligned components.
• Transferability is backbone dependent: suffixes optimised on one backbone transfer well within that backbone family but far less so across different backbones.
• BAJ outperforms a variety of prior jailbreak methods, retaining a 24 to 48 percentage point advantage in transfer success even when baselines are given matched surrogate access and compute budget.
• BAJ remains effective across different merging algorithms and deployment configurations including quantisation and watermarking, and its computational cost is moderate; merging steps are cheap and the probe is lightweight.
• Human evaluation of successful BAJ outputs found 68% coherent harmful responses, 32% partially coherent, and 0% incoherent, supporting the judge's validity.
• An adaptive defence consisting of fine-tuning merged models on BAJ-generated adversarial prompts with refusal labels substantially reduces BAJ effectiveness, indicating some post-merge mitigation is possible.

Limitations

The study assumes access to surrogate fine-tuned models built from the same backbone and parameterises the basin via task arithmetic, which may not capture all real-world merging regimes. The work focuses on identifying and characterising the risk rather than delivering complete, generalisable mitigations. Some transfer drops occur when evaluation merges lie outside the assumed basin. Experiments rely on a specific LLM judge but are supported by human annotation.

Implications

Offensively, an attacker who knows a model's pretrained backbone can craft a single adversarial suffix that generalises across many merged deployments without needing exact weights or checkpoints, expanding exploitable surface area to ensembles and merged families. Such suffixes can bypass defences aimed at single models and persist under different merge algorithms and runtime settings. The backbone dependence suggests attackers will try to target widely reused upstream checkpoints. These results indicate a need for provenance-aware safety evaluations and merge-aware defences in deployment pipelines.