用黑盒方法高效生成能绕过大模型安全限制的自然文本攻击
GASP: Efficient Black-Box Generation of Adversarial Suffixes for Jailbreaking LLMs
- 基于潜在空间贝叶斯优化，自动构造连贯且隐蔽的恶意后缀
- 在多个模型上成功率超基线，训练时间缩短60%以上
- 适合安全测试人员快速评估大模型防御能力
大语言模型在多项自然语言任务中表现优异，但仍易受精心设计的提示攻击，即越狱攻击，这些提示可绕过安全防护机制并诱导有害响应。传统方法依赖人工启发式规则，泛化能力差；而基于优化的自动化攻击通常生成不自然的提示，易被安全过滤器识别，且因离散标记优化导致计算成本高。本文提出生成对抗后缀提示器（GASP），一种全新的全自动框架，可在完全黑盒设置下高效生成人类可读的越狱提示。GASP利用潜在空间贝叶斯优化，在连续嵌入空间中探索并构建对抗性后缀，通过目标导向的迭代精炼过程逐步提升攻击效果，同时保持提示的语义连贯性。大量实验表明，GASP生成的提示更具自然性，显著提升越狱成功率，训练时间减少超60%，推理速度更快，为大模型红队测试提供高效可扩展的解决方案。
原文摘要 · Abstract (English)
LLMs have shown impressive capabilities across various natural language processing tasks, yet remain vulnerable to input prompts, known as jailbreak attacks, carefully designed to bypass safety guardrails and elicit harmful responses. Traditional methods rely on manual heuristics but suffer from limited generalizability. Despite being automatic, optimization-based attacks often produce unnatural prompts that can be easily detected by safety filters or require high computational costs due to discrete token optimization. In this paper, we introduce Generative Adversarial Suffix Prompter (GASP), a novel automated framework that can efficiently generate human-readable jailbreak prompts in a fully black-box setting. In particular, GASP leverages latent Bayesian optimization to craft adversarial suffixes by efficiently exploring continuous latent embedding spaces, gradually optimizing the suffix prompter to improve attack efficacy while balancing prompt coherence via a targeted iterative refinement procedure. Through comprehensive experiments, we show that GASP can produce natural adversarial prompts, significantly improving jailbreak success over baselines, reducing training times, and accelerating inference speed, thus making it an efficient and scalable solution for red-teaming LLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。