用强化学习训练的模型自动生成越狱攻击，成功率大幅提升。
LLMStinger: Jailbreaking LLMs using RL fine-tuned LLMs
- 用RL微调攻击模型，自动生成越狱后缀。
- 在多个主流模型上提升超50%越狱成功率。
- 适合安全测试与对抗样本研究者参考。
我们提出LLMStinger，一种利用大语言模型自动生成越狱攻击后缀的新方法。不同于传统依赖复杂提示工程或白盒访问的方法，LLMStinger通过强化学习循环微调攻击者模型，基于HarmBench基准中已有的有害问题生成新后缀。相比15种最新红队方法，该方法在已知具备严格安全机制的LLaMA2-7B-chat上实现+57.2%的攻击成功率（ASR）提升，在Claude 2上提升+50.3%；同时在GPT-3.5上达到94.97%的ASR，Gemma-2B-it上达99.4%，展现出对开源与闭源模型的强大适应性与鲁棒性。
原文摘要 · Abstract (English)
We introduce LLMStinger, a novel approach that leverages Large Language Models (LLMs) to automatically generate adversarial suffixes for jailbreak attacks. Unlike traditional methods, which require complex prompt engineering or white-box access, LLMStinger uses a reinforcement learning (RL) loop to fine-tune an attacker LLM, generating new suffixes based on existing attacks for harmful questions from the HarmBench benchmark. Our method significantly outperforms existing red-teaming approaches (we compared against 15 of the latest methods), achieving a +57.2% improvement in Attack Success Rate (ASR) on LLaMA2-7B-chat and a +50.3% ASR increase on Claude 2, both models known for their extensive safety measures. Additionally, we achieved a 94.97% ASR on GPT-3.5 and 99.4% on Gemma-2B-it, demonstrating the robustness and adaptability of LLMStinger across open and closed-source models.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。