通过可逆字符串组合，自动化生成高效越狱攻击。
Plentiful Jailbreaks with String Compositions
- 提出可逆字符串变换框架，支持任意组合编码解码。
- 在HarmBench上对前沿模型实现高成功率越狱攻击。
- 适合安全测试与红队攻防研究者参考。
大型语言模型仍易受各类对抗性攻击和越狱方法影响。白帽攻击者（红队）常采用字符串级混淆技术处理输入输出，如莱特语、旋转密码、Base64、ASCII等。本文将这些编码攻击统一为可逆字符串变换框架，支持任意变换序列的端到端编码与解码。基于此，我们设计了自动化的Best-of-N攻击策略，从组合爆炸的字符串变换中采样。在HarmBench评测下，该方法对多个前沿大模型取得有竞争力的攻击成功率，表明编码类攻击仍是先进LLM的持久漏洞。
原文摘要 · Abstract (English)
Large language models (LLMs) remain vulnerable to a slew of adversarial attacks and jailbreaking methods. One common approach employed by white-hat attackers, or red-teamers, is to process model inputs and outputs using string-level obfuscations, which can include leetspeak, rotary ciphers, Base64, ASCII, and more. Our work extends these encoding-based attacks by unifying them in a framework of invertible string transformations. With invertibility, we can devise arbitrary string compositions, defined as sequences of transformations, that we can encode and decode end-to-end programmatically. We devise a automated best-of-n attack that samples from a combinatorially large number of string compositions. Our jailbreaks obtain competitive attack success rates on several leading frontier models when evaluated on HarmBench, highlighting that encoding-based attacks remain a persistent vulnerability even in advanced LLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。