通过可调控复杂度的编码破解大模型安全机制，发现越强大的模型越易被攻破。
Endless Jailbreaks with Bijection Learning
- 用双向编码映射自动探测模型漏洞，编码复杂度可精确控制。
- 在多个前沿大模型上成功绕过安全机制，且模型越强攻击越有效。
- 揭示了模型能力提升反而增加安全风险，适合安全研究者关注。
尽管有广泛的安全措施，大语言模型仍易受对抗输入（即越狱攻击）影响，诱发不当行为。本文提出双射学习（bijection learning），一种能自动探测模型安全漏洞的攻击算法，通过生成可调控复杂度的随机编码对模型进行模糊测试。利用上下文学习训练模型掌握双射编码，将编码后的查询输入模型以绕过内置安全机制，再将模型输出解码回英文。该攻击在多种前沿语言模型上均表现极强效果。通过控制编码中键值对数量等复杂度参数，我们发现被攻击模型的能力水平与其最有效攻击的平均复杂度之间存在紧密关系：模型越强大，越容易被高复杂度的双射攻击成功越狱。本工作表明，随着模型规模扩大，新安全漏洞可能涌现，更强大的模型反而面临更严重的越狱风险。
原文摘要 · Abstract (English)
Despite extensive safety measures, LLMs are vulnerable to adversarial inputs, or jailbreaks, which can elicit unsafe behaviors. In this work, we introduce bijection learning, a powerful attack algorithm which automatically fuzzes LLMs for safety vulnerabilities using randomly-generated encodings whose complexity can be tightly controlled. We leverage in-context learning to teach models bijective encodings, pass encoded queries to the model to bypass built-in safety mechanisms, and finally decode responses back into English. Our attack is extremely effective on a wide range of frontier language models. Moreover, by controlling complexity parameters such as number of key-value mappings in the encodings, we find a close relationship between the capability level of the attacked LLM and the average complexity of the most effective bijection attacks. Our work highlights that new vulnerabilities in frontier models can emerge with scale: more capable models are more severely jailbroken by bijection attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。