@inproceedings{yu-etal-2026-reward,
title = "Reward-guided Meta-Prompt Evolving with Reflection for {LLM} Jailbreaking",
author = "Yu, Caiyang and
Ju, Wei and
Liu, Yun and
Long, Qingqing and
Yi, Siyu and
Wang, Yifan and
Luo, Junyu and
Qiao, Ziyue",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.75/",
pages = "1533--1551",
ISBN = "979-8-89176-462-0",
abstract = "Large language model (LLM) safety has received extensive attention since LLMs are vulnerable to manipulation. To understand and mitigate the risk, this paper studies the problem of jailbreak attacks on LLMs, which aim to deliberately break the safety guard of LLMs for harmful or unethical responses. Current black-box jailbreak attacks are limited by either a reliance on human expertise for manual prompt design or by intricate workflows in automated approaches. Towards this end, we propose a novel approach named Reward-guided Meta-prompt Evolving with reflection (ROOT) for automatic jailbreak attack generation. The core idea of our ROOT is to optimize a meta-prompt using attack rewards as jailbreak guidance. In particular, our ROOT feeds a meta-prompt with toxic questions into LLMs to generate prompts for jailbreak attempts. The responses from these attempts are further evaluated using a judge model, which further summarizes the reflection of both successful and unsuccessful jailbreak attempts into different meta-prompt optimization strategies. To reduce the noise, we estimate their reward scores to select high-quality strategies, which can optimize our meta-prompt for better attack generation ability. Extensive experiments show that ROOT demonstrates strong generalizability and broad adaptability by achieving high jailbreak success rates (above 90{\%}) across both multiple LLMs and various categories of harmful tasks."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="yu-etal-2026-reward">
<titleInfo>
<title>Reward-guided Meta-Prompt Evolving with Reflection for LLM Jailbreaking</title>
</titleInfo>
<name type="personal">
<namePart type="given">Caiyang</namePart>
<namePart type="family">Yu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Wei</namePart>
<namePart type="family">Ju</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yun</namePart>
<namePart type="family">Liu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Qingqing</namePart>
<namePart type="family">Long</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Siyu</namePart>
<namePart type="family">Yi</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yifan</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Junyu</namePart>
<namePart type="family">Luo</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ziyue</namePart>
<namePart type="family">Qiao</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Large language model (LLM) safety has received extensive attention since LLMs are vulnerable to manipulation. To understand and mitigate the risk, this paper studies the problem of jailbreak attacks on LLMs, which aim to deliberately break the safety guard of LLMs for harmful or unethical responses. Current black-box jailbreak attacks are limited by either a reliance on human expertise for manual prompt design or by intricate workflows in automated approaches. Towards this end, we propose a novel approach named Reward-guided Meta-prompt Evolving with reflection (ROOT) for automatic jailbreak attack generation. The core idea of our ROOT is to optimize a meta-prompt using attack rewards as jailbreak guidance. In particular, our ROOT feeds a meta-prompt with toxic questions into LLMs to generate prompts for jailbreak attempts. The responses from these attempts are further evaluated using a judge model, which further summarizes the reflection of both successful and unsuccessful jailbreak attempts into different meta-prompt optimization strategies. To reduce the noise, we estimate their reward scores to select high-quality strategies, which can optimize our meta-prompt for better attack generation ability. Extensive experiments show that ROOT demonstrates strong generalizability and broad adaptability by achieving high jailbreak success rates (above 90%) across both multiple LLMs and various categories of harmful tasks.</abstract>
<identifier type="citekey">yu-etal-2026-reward</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.75/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>1533</start>
<end>1551</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Reward-guided Meta-Prompt Evolving with Reflection for LLM Jailbreaking
%A Yu, Caiyang
%A Ju, Wei
%A Liu, Yun
%A Long, Qingqing
%A Yi, Siyu
%A Wang, Yifan
%A Luo, Junyu
%A Qiao, Ziyue
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F yu-etal-2026-reward
%X Large language model (LLM) safety has received extensive attention since LLMs are vulnerable to manipulation. To understand and mitigate the risk, this paper studies the problem of jailbreak attacks on LLMs, which aim to deliberately break the safety guard of LLMs for harmful or unethical responses. Current black-box jailbreak attacks are limited by either a reliance on human expertise for manual prompt design or by intricate workflows in automated approaches. Towards this end, we propose a novel approach named Reward-guided Meta-prompt Evolving with reflection (ROOT) for automatic jailbreak attack generation. The core idea of our ROOT is to optimize a meta-prompt using attack rewards as jailbreak guidance. In particular, our ROOT feeds a meta-prompt with toxic questions into LLMs to generate prompts for jailbreak attempts. The responses from these attempts are further evaluated using a judge model, which further summarizes the reflection of both successful and unsuccessful jailbreak attempts into different meta-prompt optimization strategies. To reduce the noise, we estimate their reward scores to select high-quality strategies, which can optimize our meta-prompt for better attack generation ability. Extensive experiments show that ROOT demonstrates strong generalizability and broad adaptability by achieving high jailbreak success rates (above 90%) across both multiple LLMs and various categories of harmful tasks.
%U https://aclanthology.org/2026.findings-emnlp.75/
%P 1533-1551
Markdown (Informal)
[Reward-guided Meta-Prompt Evolving with Reflection for LLM Jailbreaking](https://aclanthology.org/2026.findings-emnlp.75/) (Yu et al., Findings 2026)
ACL
- Caiyang Yu, Wei Ju, Yun Liu, Qingqing Long, Siyu Yi, Yifan Wang, Junyu Luo, and Ziyue Qiao. 2026. Reward-guided Meta-Prompt Evolving with Reflection for LLM Jailbreaking. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 1533–1551, Budapest, Hungary. Association for Computational Linguistics.