用思维链提升对抗攻击效果，让大模型更易被误导。
Enhancing Adversarial Attacks through Chain of Thought
- 将思维链提示融入贪婪坐标梯度法，激发模型推理能力
- 攻击成功率显著高于基线方法，且更具通用性
- 适合研究模型安全、对抗攻防的开发者和研究人员
大型语言模型在多个领域表现优异，但存在安全风险。已有研究表明，基于梯度的对抗攻击对对齐后的模型尤为有效，而思维链（CoT）提示能通过逐步推理引导模型生成期望回答。本文提出将CoT提示与贪婪坐标梯度（GCG）技术结合，以增强对齐后大模型的对抗攻击能力。使用思维链触发而非明确目标，可激发后端模型的推理能力，从而提升攻击的迁移性和普适性。消融实验表明，该方法优于基线GCG攻击和亚马逊AWS的Auto-CoT。此外，采用Llama Guard评估潜在有害交互，相比匹配拒绝词，能更客观地衡量整段对话的风险。代码已公开于https://github.com/sujingbo0217/CS222W24-LLM-Attack。
原文摘要 · Abstract (English)
Large language models (LLMs) have demonstrated impressive performance across various domains but remain susceptible to safety concerns. Prior research indicates that gradient-based adversarial attacks are particularly effective against aligned LLMs and the chain of thought (CoT) prompting can elicit desired answers through step-by-step reasoning. This paper proposes enhancing the robustness of adversarial attacks on aligned LLMs by integrating CoT prompts with the greedy coordinate gradient (GCG) technique. Using CoT triggers instead of affirmative targets stimulates the reasoning abilities of backend LLMs, thereby improving the transferability and universality of adversarial attacks. We conducted an ablation study comparing our CoT-GCG approach with Amazon Web Services auto-cot. Results revealed our approach outperformed both the baseline GCG attack and CoT prompting. Additionally, we used Llama Guard to evaluate potentially harmful interactions, providing a more objective risk assessment of entire conversations compared to matching outputs to rejection phrases. The code of this paper is available at https://github.com/sujingbo0217/CS222W24-LLM-Attack.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。