用良性数据训练镜像模型，隐蔽生成越狱提示。
Stealthy Jailbreak Attacks on Large Language Models via Benign Data Mirroring
- 通过良性数据蒸馏训练目标模型的镜像模型。
- 在GPT-3.5 Turbo上达92%攻击成功率，平均每样本仅1.5次可检测查询。
- 适合研究模型安全与对抗性攻击的学者参考。
大型语言模型（LLM）安全性至关重要，现有红队测试常采用越狱方法探测潜在漏洞，即构造恶意提示诱导模型输出违背安全对齐的内容。当前黑盒越狱方法多依赖模型反馈，攻击搜索过程中反复提交带有明显恶意指令的查询，易被内容审核拦截。本文提出一种改进的迁移攻击方法：通过良性数据蒸馏，在本地训练目标黑盒模型的镜像模型，以指导恶意提示的构建。该方法在搜索阶段无需向目标模型提交可识别的恶意指令，显著提升隐蔽性。在AdvBench子集上对GPT-3.5 Turbo测试，最高攻击成功率达92%，平衡指标为80%，平均每样本仅1.5次可检测的越狱查询。结果凸显需建立更鲁棒的防御机制。
原文摘要 · Abstract (English)
Large language model (LLM) safety is a critical issue, with numerous studies employing red team testing to enhance model security. Among these, jailbreak methods explore potential vulnerabilities by crafting malicious prompts that induce model outputs contrary to safety alignments. Existing black-box jailbreak methods often rely on model feedback, repeatedly submitting queries with detectable malicious instructions during the attack search process. Although these approaches are effective, the attacks may be intercepted by content moderators during the search process. We propose an improved transfer attack method that guides malicious prompt construction by locally training a mirror model of the target black-box model through benign data distillation. This method offers enhanced stealth, as it does not involve submitting identifiable malicious instructions to the target model during the search phase. Our approach achieved a maximum attack success rate of 92%, or a balanced value of 80% with an average of 1.5 detectable jailbreak queries per sample against GPT-3.5 Turbo on a subset of AdvBench. These results underscore the need for more robust defense mechanisms.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。