Kihyun Kim, Hee-Seon Kim, Wonjun Lee, Changick Kim

Korea Advanced Institute of Science and Technology (KAIST)

News

• 2026.09 Our paper has been accepted to AACL-IJCNLP 2026 (Main)! 🎉
• 2026.08 Paper is available on arXiv!
• 2026.08 Code is released!

Overview

Batch prompting is a practical inference strategy that packs multiple queries into a single call. We show that its success for utility does not extend to safety: a harmful question that is reliably refused in isolation can elicit a harmful response when embedded in a batch of benign questions.

This repository provides the official code to:

1. Generate batch-prompt attack data
2. Run inference on open-source models (Phi / Llama / Qwen) and commercial APIs (GPT / Gemini / Claude)
3. Evaluate attack success with an ensemble of LlamaGuard-4, WildGuard, and Beaver-Dam

Preparation

1. Clone this repository.

git clone https://github.com/96kihyun/batch_jailbreak.git
cd batch_jailbreak

2. Environment setup

conda create -n batch python=3.10 -y
conda activate batch
pip install -r requirements.txt

GPU is required for local model inference and for the three judge models. Tested with Python 3.10 + PyTorch 2.4 + transformers==5.2.

Note: src/evaluate/llamaguard4/ ships a vendored copy of transformers for LlamaGuard-4 (Llama4ForConditionalGeneration). It is added to sys.path only while LlamaGuard is loading.

3. Register models / API keys

Edit configs/models.yaml with local HuggingFace checkpoint paths (generators + judges), and set API keys in configs/api.yaml (or via env vars OPENAI_API_KEY / GEMINI_API_KEY / ANTHROPIC_API_KEY / HF_TOKEN).

Required data & models

• Benign filler: data/context_dataset/gsm8k.jsonl (each line has a "question" key)
• Harmful datasets (auto-downloaded): JailbreakBench/JBB-Behaviors, walledai/StrongREJECT
• Generators: Phi-4 / Llama-3.1-8B-Instruct / Qwen3-8B
• Judges: Llama-Guard-4-12B, PKU-Alignment/beaver-dam-7b, allenai/wildguard

Generating Batch-Prompt Data

Default: --harmful_dataset JBB, batch size n = 1..10, 313 samples. Benign slots are filled from GSM8K (single_math).

python -m src.utils.generate_batch_question_prompt

Outputs are written under data/batch_prompt/single_math/{n}/pos_{k}.jsonl.

Running Inference

Open-source models (Phi / Llama / Qwen)

python scripts/inference/run_inference_batch_prompt.py \
  --model_name qwen \
  --case single_math --n 9 --pos 2 \
  --harmful_dataset JBB

Batched sweep over (model, case, batch_size, pos):

bash scripts/inference/run_inference_batch_prompt_eval.sh \
  --dataset jbb --gpu_id 0 \
  --models phi qwen --cases single_math \
  --batch_sizes 12 --pos_values 1 2

Commercial APIs (GPT / Gemini / Claude)

python scripts/inference/run_inference_api.py \
  --api gpt \
  --input_file data/batch_prompt_jbb/single_math/12/pos_2.jsonl \
  --model_name gpt --output_subdir batch_prompt_jbb/single_math/12/pos_2 \
  --harmful_dataset JBB --extract_pos 2

Outputs are saved under result/inference/<model>/... as JSONL with {prompt, response} pairs.

Evaluating Attack Success

Each response is scored by LlamaGuard-4, WildGuard, and Beaver-Dam, then combined by majority vote:

python scripts/eval/run_ensemble.py \
  --input_file result/inference/qwen/batch_prompt_jbb/single_math/12/qwen_single_math_n12_pos_2_response.jsonl \
  --output_dir result/evaluation/batch_prompt_jbb/qwen/single_math/12/pos_2

You can also run evaluation in the same loop as inference:

bash scripts/inference/run_inference_batch_prompt_eval.sh \
  --dataset jbb --gpu_id 0 \
  --models qwen --cases single_math \
  --batch_sizes 12 --pos_values 2 \
  --conda_env batch

Quick Start (Smoke Run)

# 1. data
python -m src.utils.generate_batch_question_prompt \
  --harmful_dataset JBB --min_n 12 --max_n 12 --num_samples 100

# 2. inference
python scripts/inference/run_inference_batch_prompt.py \
  --model_name llama --case single_math --n 12 --pos 2 --harmful_dataset JBB

# 3. evaluation
python scripts/eval/run_ensemble.py \
  --input_file result/inference/llama/batch_prompt/llama_single_math_n12_pos_2_response.jsonl

Citation

Please consider citing our paper if our work helps your research.

@article{kim2026safety,
  title={Safety in Batches? Understanding and Mitigating Safety Failures in Batch Prompting},
  author={Kim, Kihyun and Kim, HeeSeon and Lee, Wonjun and Kim, Changick},
  journal={arXiv preprint arXiv:2608.02681},
  year={2026}
}

Contact

For any questions about our paper or code, please email [email protected].