通过左侧加噪伪装恶意指令，1次查询突破大模型安全限制
FlipAttack: Jailbreak LLMs via Flipping
- 利用大模型自回归特性，在提示词左侧添加噪声伪装攻击意图
- 对GPT-4o攻击成功率近98%，5种防护模型平均绕过率超98%
- 无需训练、单次查询即可生效，适合研究对抗攻击的开发者
本文提出一种针对黑盒大语言模型的简单而有效的越狱攻击方法FlipAttack。基于自回归生成特性，发现大模型倾向于从左到右理解文本，且在左侧添加噪声后难以正确解析。受此启发，仅依据原始提示构造左侧噪声，提出四种翻转模式。进一步验证大模型具备强大的文本翻转能力，设计四类变体引导其去噪、理解并执行有害行为。该方法保持通用性、隐蔽性和简洁性，仅需一次查询即可越狱。在8个大模型上实验表明其优越性：对GPT-4o攻击成功率约98%，对5种护栏模型平均绕过率约98%。代码已开源。
原文摘要 · Abstract (English)
This paper proposes a simple yet effective jailbreak attack named FlipAttack against black-box LLMs. First, from the autoregressive nature, we reveal that LLMs tend to understand the text from left to right and find that they struggle to comprehend the text when noise is added to the left side. Motivated by these insights, we propose to disguise the harmful prompt by constructing left-side noise merely based on the prompt itself, then generalize this idea to 4 flipping modes. Second, we verify the strong ability of LLMs to perform the text-flipping task, and then develop 4 variants to guide LLMs to denoise, understand, and execute harmful behaviors accurately. These designs keep FlipAttack universal, stealthy, and simple, allowing it to jailbreak black-box LLMs within only 1 query. Experiments on 8 LLMs demonstrate the superiority of FlipAttack. Remarkably, it achieves $\sim$98\% attack success rate on GPT-4o, and $\sim$98\% bypass rate against 5 guardrail models on average. The codes are available at GitHub\footnote{https://github.com/yueliu1999/FlipAttack}.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。