通过修改模型内部结构实现隐蔽的越狱攻击，不依赖输入触发。
Model-Editing-Based Jailbreak against Safety-aligned Large Language Models
- 直接修改模型参数，移除安全限制的内部转换机制。
- 在4个主流开源模型上平均攻击成功率达84.86%。
- 无需恶意输入或训练数据，适合研究模型安全漏洞者。
大型语言模型（LLMs）虽推动了自然语言交互的发展，但仍易受越狱攻击影响。现有方法多依赖输入修改，易被检测且难以隐蔽扩展。本文提出靶向模型编辑（TME），一种白盒新方法，通过最小化修改模型内部结构来绕过安全过滤，同时保持模型原有功能。TME分析安全与非安全查询的激活模式差异，通过优化过程识别并近似移除嵌入模型矩阵中的安全关键转换（SCTs），使恶意请求无需输入改动即可绕过限制。在D-LLM框架中实现，该方法在四个主流开源LLM上取得平均84.86%的攻击成功率，且性能保持良好。相比现有技术，D-LLM无需特定触发词或有害响应数据集，提供更隐蔽高效的越狱策略。本工作揭示了模型安全对齐中潜在的隐蔽威胁，强调需加强模型防护机制。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have transformed numerous fields by enabling advanced natural language interactions but remain susceptible to critical vulnerabilities, particularly jailbreak attacks. Current jailbreak techniques, while effective, often depend on input modifications, making them detectable and limiting their stealth and scalability. This paper presents Targeted Model Editing (TME), a novel white-box approach that bypasses safety filters by minimally altering internal model structures while preserving the model's intended functionalities. TME identifies and removes safety-critical transformations (SCTs) embedded in model matrices, enabling malicious queries to bypass restrictions without input modifications. By analyzing distinct activation patterns between safe and unsafe queries, TME isolates and approximates SCTs through an optimization process. Implemented in the D-LLM framework, our method achieves an average Attack Success Rate (ASR) of 84.86% on four mainstream open-source LLMs, maintaining high performance. Unlike existing methods, D-LLM eliminates the need for specific triggers or harmful response collections, offering a stealthier and more effective jailbreak strategy. This work reveals a covert and robust threat vector in LLM security and emphasizes the need for stronger safeguards in model safety alignment.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。