将有害问题拆解成多轮无害片段，诱导大模型泄露违规内容。
Jigsaw Puzzles: Splitting Harmful Questions to Jailbreak Large Language Models
- 分步提问：把有害问题拆成多个无害子问题逐轮输入。
- 攻击成功率93.76%，在5个主流模型上均突破安全防护。
- 可绕过现有防御机制，适合研究模型安全的人员阅读。
大型语言模型（LLMs）凭借其庞大的隐含知识和强大的推理能力，在与人类互动和解答复杂问题方面表现出色。然而，这些模型易受越狱攻击，导致生成有害内容。尽管已有针对单轮越狱策略的研究，但多轮场景下的漏洞揭示仍相对不足。本文提出Jigsaw Puzzles（JSP），一种简单而高效的多轮越狱策略。JSP将有害问题拆分为若干无害片段，作为多轮交互中的每轮输入，要求模型逐步重构并回答。实验表明，该方法在189个有害查询上对5个先进模型（Gemini-1.5-Pro、Llama-3.1-70B、GPT-4、GPT-4o、GPT-4o-mini）平均攻击成功率达93.76%。尤其在GPT-4上达到92%的当前最优攻击成功率，并对防御策略表现出强鲁棒性。警告：本文包含不当示例。
原文摘要 · Abstract (English)
Large language models (LLMs) have exhibited outstanding performance in engaging with humans and addressing complex questions by leveraging their vast implicit knowledge and robust reasoning capabilities. However, such models are vulnerable to jailbreak attacks, leading to the generation of harmful responses. Despite recent research on single-turn jailbreak strategies to facilitate the development of defence mechanisms, the challenge of revealing vulnerabilities under multi-turn setting remains relatively under-explored. In this work, we propose Jigsaw Puzzles (JSP), a straightforward yet effective multi-turn jailbreak strategy against the advanced LLMs. JSP splits questions into harmless fractions as the input of each turn, and requests LLMs to reconstruct and respond to questions under multi-turn interaction. Our experimental results demonstrate that the proposed JSP jailbreak bypasses original safeguards against explicitly harmful content, achieving an average attack success rate of 93.76% on 189 harmful queries across 5 advanced LLMs (Gemini-1.5-Pro, Llama-3.1-70B, GPT-4, GPT-4o, GPT-4o-mini). Moreover, JSP achieves a state-of-the-art attack success rate of 92% on GPT-4 on the harmful query benchmark, and exhibits strong resistant to defence strategies. Warning: this paper contains offensive examples.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。