用快速采样破解大模型安全机制，秒级完成攻击
LIAR: Leveraging Inference Time Alignment (Best-of-N) to Jailbreak LLMs in Seconds
- 在推理时通过最佳N采样实现无训练黑盒攻击
- 成功率达顶尖水平，攻击时间从小时缩短至秒级
- 适合评估模型安全性和研究对齐机制的科研人员
越狱攻击通过精心设计的提示词，使经过安全对齐的大语言模型输出有害内容。现有方法依赖离散优化或训练过的对抗生成器，但速度慢、计算量大且不实用。本文认为这些低效源于对问题的错误理解，将越狱视为推理时的对齐偏差，并提出LIAR（利用推理时对齐偏差越狱），一种无需训练的快速黑盒最佳N采样攻击。LIAR在保持顶尖成功率的同时，将困惑度降低10倍，攻击时间由小时级降至秒级。此外，我们引入理论性“安全防护网”指标来量化安全对齐强度，并推导出次优性边界。该工作为评估大模型鲁棒性及推进对齐研究提供了简单而有效的工具。
原文摘要 · Abstract (English)
Jailbreak attacks expose vulnerabilities in safety-aligned LLMs by eliciting harmful outputs through carefully crafted prompts. Existing methods rely on discrete optimization or trained adversarial generators, but are slow, compute-intensive, and often impractical. We argue that these inefficiencies stem from a mischaracterization of the problem. Instead, we frame jailbreaks as inference-time misalignment and introduce LIAR (Leveraging Inference-time misAlignment to jailbReak), a fast, black-box, best-of-$N$ sampling attack requiring no training. LIAR matches state-of-the-art success rates while reducing perplexity by $10\times$ and Time-to-Attack from hours to seconds. We also introduce a theoretical "safety net against jailbreaks" metric to quantify safety alignment strength and derive suboptimality bounds. Our work offers a simple yet effective tool for evaluating LLM robustness and advancing alignment research.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。