通过分阶段生成内容，提升对大模型的越狱攻击成功率
AdaPPA: Adaptive Position Pre-Fill Jailbreak Attack Approach Targeting LLMs
- 先输出安全内容再切换叙事，避开模型防护机制
- 在Llama2上攻击成功率提升47%
- 适合研究模型安全与对抗攻击的学者
大型语言模型（LLMs）的越狱漏洞指通过精心设计的提示或后缀提取恶意内容的方法，受到研究界广泛关注。然而，传统攻击方法主要关注语义层面，易被模型检测。这些方法忽略了模型在不同输出阶段对对齐保护能力的差异。为此，本文提出一种自适应位置预填充越狱攻击方法，利用模型的指令遵循能力先输出预填充的安全内容，再利用其叙事转换能力生成有害内容。大量黑盒实验表明，该方法相较于现有方法，在广泛认可的安全模型（Llama2）上的攻击成功率提升了47%。代码已公开于：https://github.com/Yummy416/AdaPPA。
原文摘要 · Abstract (English)
Jailbreak vulnerabilities in Large Language Models (LLMs) refer to methods that extract malicious content from the model by carefully crafting prompts or suffixes, which has garnered significant attention from the research community. However, traditional attack methods, which primarily focus on the semantic level, are easily detected by the model. These methods overlook the difference in the model's alignment protection capabilities at different output stages. To address this issue, we propose an adaptive position pre-fill jailbreak attack approach for executing jailbreak attacks on LLMs. Our method leverages the model's instruction-following capabilities to first output pre-filled safe content, then exploits its narrative-shifting abilities to generate harmful content. Extensive black-box experiments demonstrate our method can improve the attack success rate by 47% on the widely recognized secure model (Llama2) compared to existing approaches. Our code can be found at: https://github.com/Yummy416/AdaPPA.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。