通过迭代自调优提升大模型越狱能力，效率更高、成功率接近100%。
Iterative Self-Tuning LLMs for Enhanced Jailbreaking Capabilities
- 设计迭代自调优框架，用少量计算生成高成功率越狱后缀。
- 在开源模型上实现近100%越狱成功率，对GPT-3.5达99%。
- 可生成安全研究数据集，适合安全对抗与对齐研究者参考。
近期研究表明，大型语言模型（LLMs）易受自动化越狱攻击，即通过算法生成的恶意后缀附加到有害查询中，绕过安全对齐机制并触发非预期响应。现有生成后缀的方法计算成本高且攻击成功率低，尤其在对齐良好的模型如Llama2和Llama3上表现不佳。为此，我们提出ADV-LLM，一种迭代自调优流程，可生成具备更强越狱能力的对抗性大模型。该框架显著降低生成对抗后缀的计算开销，同时在多种开源模型上实现接近100%的攻击成功率（ASR）。此外，其攻击具有强迁移性，即使仅在Llama3上优化，仍能在GPT-3.5上达到99%的ASR，GPT-4上达49%。除提升越狱能力外，ADV-LLM还可生成大规模数据集，为未来安全对齐研究提供重要洞见。代码已公开：https://github.com/SunChungEn/ADV-LLM。
原文摘要 · Abstract (English)
Recent research has shown that Large Language Models (LLMs) are vulnerable to automated jailbreak attacks, where adversarial suffixes crafted by algorithms appended to harmful queries bypass safety alignment and trigger unintended responses. Current methods for generating these suffixes are computationally expensive and have low Attack Success Rates (ASR), especially against well-aligned models like Llama2 and Llama3. To overcome these limitations, we introduce ADV-LLM, an iterative self-tuning process that crafts adversarial LLMs with enhanced jailbreak ability. Our framework significantly reduces the computational cost of generating adversarial suffixes while achieving nearly 100\% ASR on various open-source LLMs. Moreover, it exhibits strong attack transferability to closed-source models, achieving 99\% ASR on GPT-3.5 and 49\% ASR on GPT-4, despite being optimized solely on Llama3. Beyond improving jailbreak ability, ADV-LLM provides valuable insights for future safety alignment research through its ability to generate large datasets for studying LLM safety. Our code is available at: https://github.com/SunChungEn/ADV-LLM
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。