---
title: "Beihang's AGILE Jailbreak Beats Top AI Safety Defenses by 37%"
subtitle: "A two-stage attack combines context rewriting with hidden-state-guided token edits, boosting jailbreak success by up to 37.74% and transferring across models."
url: "https://alphasignal.ai/news/beihang-s-agile-jailbreak-beats-top-ai-safety-defenses-by-37"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "AlphaSignal"
company_url: "https://alphasignal.ai/company/alphasignal"
published: "2026-04-15T00:00:00.000Z"
updated: "2026-08-23T21:26:27.221Z"
type: "Paper"
topics:
  - "Security"
  - "Llms"
subtopics:
  - "Red Teaming"
  - "Jailbreaks"
  - "Hallucinations"
upvotes: 931
source_url: "https://arxiv.org/abs/2508.00555"
comments: 0
truncated: true
---

# Beihang's AGILE Jailbreak Beats Top AI Safety Defenses by 37%

> A two-stage attack combines context rewriting with hidden-state-guided token edits, boosting jailbreak success by up to 37.74% and transferring across models.

A team from Beihang University, HKUST, and collaborators has released [AGILE](https://arxiv.org/abs/2508.00555) (Activation-Guided Local Editing), a jailbreak framework that fuses two attack styles previously at odds. It generates a plausible conversation around a harmful request, then makes surgical token-level edits guided by the target model's own internal activations. The reported results include gains of up to 37.74% in attack success rate over the strongest baseline, and strong transfer to black-box and large-scale models.

## Two attack families, two sets of weaknesses

Jailbreak research has largely split into two camps. Token-level attacks like GCG use gradient search to append adversarial suffixes that flip a model's refusal. Prompt-level attacks lean on social engineering, role-play, and nested scenarios. Both have known failure modes.

Suffix attacks tend to produce incoherent or unreadable strings, which simple rule-based filters catch easily, and they rarely transfer from a white-box model to a black-box one. Prompt-level methods scale poorly because they lean on manual craftsmanship, while their automated cousins burn compute in iterative query loops against the target.

AGILE's premise is that recent interpretability work offers a shortcut. A model's hidden states for benign versus malicious inputs are highly separable, and prior work has used that signal for direct activation-level attacks. Those direct interventions require white-box access at inference. AGILE flips the idea by using the internal signal only during optimization while keeping the final attack as pure text.

## Inside the two-stage pipeline

Stage one is offline and target-agnostic. A generator LLM builds a multi-turn, seemingly benign dialogue history from style instructions and a theme, then rephrases the original malicious query into a semantically similar but more innocuous form. Only user turns are generated; the assistant replies are later sampled from the target itself for coherence.

_Preview only. Full text requires an AlphaSignal Pro account._

## Sources

- [Activation-Guided Local Editing for Jailbreaking Attacks](https://arxiv.org/abs/2508.00555)
- [AGILE GitHub Repository](https://github.com/SELGroup/AGILE)
- [AGILE HTML paper](https://arxiv.org/html/2508.00555)