用自动化模糊测试生成短小隐蔽的越狱提示，攻破大模型安全防线
PAPILLON: Efficient and Stealthy Fuzz Testing-Powered Jailbreaks for LLMs
- 基于模糊测试自动生成越狱提示，无需人工模板
- 对GPT-4成功率超78%（100词内），在主流模型上超60%提升
- 提示更短更自然，可绕过防御且跨模型通用
大型语言模型虽在多任务中表现优异，但仍易受越狱攻击，即通过特定提示诱导其生成有害内容。现有方法或依赖人工设计模板，难以扩展；或生成语义混乱提示，易被检测；且普遍使用长提示，导致查询成本高。本文提出PAPILLON框架，一种全自动黑盒越狱攻击方法，结合定制化模糊测试策略。它从空种子池开始，无需预设模板；利用大模型助手设计三种依赖问题的变异策略，保持语义连贯性的同时大幅缩短提示长度；并引入两级判断模块精准识别真实成功越狱。在7个代表性LLM上评估，对GPT-3.5 turbo、GPT-4和Gemini-Pro的成功率分别达90%、80%和74%，超越基线超60%。针对GPT-4，100 token内仍保持78%成功率。该方法具备强迁移性与抗防御能力。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have excelled in various tasks but are still vulnerable to jailbreaking attacks, where attackers create jailbreak prompts to mislead the model to produce harmful or offensive content. Current jailbreak methods either rely heavily on manually crafted templates, which pose challenges in scalability and adaptability, or struggle to generate semantically coherent prompts, making them easy to detect. Additionally, most existing approaches involve lengthy prompts, leading to higher query costs. In this paper, to remedy these challenges, we introduce a novel jailbreaking attack framework called PAPILLON, which is an automated, black-box jailbreaking attack framework that adapts the black-box fuzz testing approach with a series of customized designs. Instead of relying on manually crafted templates,PAPILLON starts with an empty seed pool, removing the need to search for any related jailbreaking templates. We also develop three novel question-dependent mutation strategies using an LLM helper to generate prompts that maintain semantic coherence while significantly reducing their length. Additionally, we implement a two-level judge module to accurately detect genuine successful jailbreaks. We evaluated PAPILLON on 7 representative LLMs and compared it with 5 state-of-the-art jailbreaking attack strategies. For proprietary LLM APIs, such as GPT-3.5 turbo, GPT-4, and Gemini-Pro, PAPILLONs achieves attack success rates of over 90%, 80%, and 74%, respectively, exceeding existing baselines by more than 60\%. Additionally, PAPILLON can maintain high semantic coherence while significantly reducing the length of jailbreak prompts. When targeting GPT-4, PAPILLON can achieve over 78% attack success rate even with 100 tokens. Moreover, PAPILLON demonstrates transferability and is robust to state-of-the-art defenses. Code: https://github.com/aaFrostnova/Papillon
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。