Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
balcony-jailbreaking — Jailbreak vulnerability across early-exit depths LLMs. Published at NeurIPS 2026 in the FLMSec workshop | Kitploit
Tools/GitHubGitHub/lassnajmuldeen/balcony-jailbreaking
Machine LearningPapers & ResearchLearning & EducationAI SecurityAdversarial Attack
GitHublassnajmuldeen/balcony-jailbreaking

balcony-jailbreaking

Jailbreak vulnerability across early-exit depths LLMs. Published at NeurIPS 2026 in the FLMSec workshop

View Repository

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
2913 days agoNot yet reviewed

Jailbreaks across model depth

How does early exit change a language model's vulnerability to jailbreaks? We study GCG attacks on Balcony-LLaMA2-7B and Balcony-LLaMA3-8B at layers 15, 18, 21, and full depth (32), using HarmBench and AdvBench.

TAO is a planned extension with experimental code. The earlier 1B runs were development tests; neither contributes results to this study.

Results

GCG over 150 steps on 50 behaviors per benchmark, run on a single NVIDIA RTX PRO 6000 Blackwell GPU. The figures and tables below come directly from the paper, which is the source of truth for reported results.

Evaluation pipeline with early exits at layers 15, 18, 21, and full depth.

GCG attack success rates by exit depth for the 7B and 8B models on HarmBench and AdvBench.

Loss curves and loss versus attack success

GCG loss over 150 steps, by model, benchmark, and exit depth.

Final GCG loss versus attack success rate on HarmBench.

Paper tables

Model configuration (Table 1).

Clean utility across six benchmarks (Table 2).

Utility with each exit's strongest GCG suffix (Table 3).

Run

Requires Linux, Python 3.12, an NVIDIA GPU, and a driver compatible with CUDA 12.8. From the repository root, install the environment and start a small GCG run:

bash scripts/setup.sh
.venv/bin/python scripts/run.py experiment --model 7b --stage gcg \
  --benchmarks harmbench --n-behaviors 2 --num-steps 5 --results-dir results/runs/pilot

Setup initializes submodules, applies toolkit patches, and installs .venv/. For gated checkpoints, accept their Hugging Face licenses and run .venv/bin/hf auth login.

For GCG, judging, and utility evaluation at all exits:

.venv/bin/python scripts/run.py experiment --model 7b

Choose --model 7b or --model 8b. New outputs stay local in results/runs/<model>/. Use --dry-run to inspect commands without loading models. Command reference.

Repository

PathContents
adapter/Early-exit model code and wrappers
experiments/Attack, evaluation, and analysis implementations
scripts/Setup and the shared runner
results/Paper figures and tables, historical archives, and local runs
third_party/Pinned dependencies and license notices

Raw archives and older exports are not synchronized with the paper. Keep 7B runs with and without chat templates separate.

Dependencies are pinned in .gitmodules; toolkit fixes are in patches/.

Download Tool