Compared to manually written jailbreak strings, our approach is significantly better than the average value, comparable with the oracle jailbreak method. Notably, while the best jailbreak method works well on the raw LM, none of the jailbreak approaches work on the RLHF chat version. We do observe that our method works slightly better on the non-chat model (\(59\) vs.