随机扰动轻松突破大模型安全防线，低成本攻击暴露系统漏洞
Stochastic Monkeys at Play: Random Augmentations Cheaply Break LLM Safety Alignment
- 用25次随机扰动输入，即可显著提升越狱成功率
- 在17个主流模型上验证，小模型和量化版本更易被攻破
- 适合研究安全漏洞的开发者与红队测试人员参考
大型语言模型（LLM）的安全对齐已成为模型开发的关键目标。为应对这一挑战，已有大量研究探索通过对抗攻击等越狱方法绕过安全机制。然而这些方法通常成本高昂或需较高创造力与资源，隐含攻击者为高资源或高技术背景的假设。本文研究了对输入提示进行简单随机扰动对先进大模型（如Llama 3、Qwen 2）安全对齐效果的影响。我们深入评估了17种不同模型，分析随机扰动在多个维度上的影响：扰动类型、模型规模、量化程度、基于微调的防御策略以及解码策略（如采样温度）。结果表明，低资源、非复杂攻击者（即“随机猴子”）仅需每条提示添加25次随机扰动，就能大幅提升越狱成功率。源代码与数据已开源。
原文摘要 · Abstract (English)
Safety alignment of Large Language Models (LLMs) has recently become a critical objective of model developers. In response, a growing body of work has been investigating how safety alignment can be bypassed through various jailbreaking methods, such as adversarial attacks. However, these jailbreak methods can be rather costly or involve a non-trivial amount of creativity and effort, introducing the assumption that malicious users are high-resource or sophisticated. In this paper, we study how simple random augmentations to the input prompt affect safety alignment effectiveness in state-of-the-art LLMs, such as Llama 3 and Qwen 2. We perform an in-depth evaluation of 17 different models and investigate the intersection of safety under random augmentations with multiple dimensions: augmentation type, model size, quantization, fine-tuning-based defenses, and decoding strategies (e.g., sampling temperature). We show that low-resource and unsophisticated attackers, i.e. $\textit{stochastic monkeys}$, can significantly improve their chances of bypassing alignment with just 25 random augmentations per prompt. Source code and data: https://github.com/uiuc-focal-lab/stochastic-monkeys/
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。