Lookahead-GCG: Improving Universal Multi-Model Optimization-Based Jailbreaking Attacks via Stochastic Nesterov Optimization

Transferable jailbreaking attacks enable red-teaming of black-box large language models by optimizing adversarial prompts on open-source surrogates. A natural approach to improve transferability is multi-model training---optimizing against multiple source models simultaneously. Yet this approach has been largely abandoned, as it yields only marginal gains with standard optimizers. We argue the root cause is poor generalization: standard gradient descent lacks stability when aggregating gradients from diverse models. Since GCG and its variants implicitly perform SGD in discrete token space, they inherit this instability in multi-model settings. We address this with Lookahead-GCG, which combines: (1) Stochastic Nesterov Accelerated Gradient (SNAG), whose lookahead mechanism reduces sensitivity to individual gradient updates, providing stability for multi-model optimization; (2) embedding-space momentum accumulation, which enables SNAG in discrete token optimization; and (3) maximally distant initialization, which exploits SNAG's improved generalization by starting from a universally beneficial point. Experiments show our method achieves 50.37% ASR on open-source and 34.03\% on closed-source LLMs, outperforming GCG and TransferAttack with +11.78% gains from multi-model optimization.

Large language models are protected by safety filters designed to block harmful requests. However, researchers have discovered universal jailbreaks: carefully crafted prompts that can bypass these protections across many different models and tasks at once. These attacks are especially concerning because they can transfer to black-box systems, including commercial models whose internal details are hidden. Improving these transferable attacks is important for stress-testing and strengthening AI safety systems. A natural idea is to train jailbreaks against several models simultaneously, with the hope that attacks learned from many models will generalize better to unseen ones. Previous methods found that multi-model training provided only small improvements. Our work investigates why this happens. We show that the problem comes from instability during optimization. Different models often provide conflicting training signals, causing existing methods to struggle when learning a single universal attack. To address this, we propose Lookahead-GCG, a new optimization framework that stabilizes multi-model jailbreak generation through lookahead updates, momentum accumulation, and improved initialization. Our method substantially improves transferability across both open-source and closed-source language models. Beyond stronger attacks, our findings provide a better understanding of how universal jailbreaks generalize, helping researchers build more reliable evaluations and ultimately more robust AI defenses.