提出MAGIC方法，加速大模型越狱攻击并保持高成功率。
Exploiting the Index Gradients for Optimization-Based Jailbreaking on Large Language Models
- 利用后缀令牌梯度信息解决优化瓶颈问题
- 在AdvBench上实现1.5倍加速，攻击成功率与基线持平或更高
- 适合研究模型安全漏洞与对抗攻击的人员参考
尽管通过对齐训练提升了大语言模型（LLMs）生成内容的安全性，这些模型仍易受越狱攻击影响。现有贪心坐标梯度（GCG）方法可自动生成越狱后缀，但优化过程耗时严重。本文分析GCG流程，发现间接效应是主要瓶颈。为此提出模型攻击梯度索引GCG（MAGIC），通过利用后缀标记的梯度信息，减少计算量和迭代次数。实验表明，在AdvBench测试中，MAGIC实现最高1.5倍加速，同时保持甚至超越基线的攻击成功率：在Llama-2上达到74%的攻击成功率，在对GPT-3.5进行迁移攻击时达54%。代码已开源。
原文摘要 · Abstract (English)
Despite the advancements in training Large Language Models (LLMs) with alignment techniques to enhance the safety of generated content, these models remain susceptible to jailbreak, an adversarial attack method that exposes security vulnerabilities in LLMs. Notably, the Greedy Coordinate Gradient (GCG) method has demonstrated the ability to automatically generate adversarial suffixes that jailbreak state-of-the-art LLMs. However, the optimization process involved in GCG is highly time-consuming, rendering the jailbreaking pipeline inefficient. In this paper, we investigate the process of GCG and identify an issue of Indirect Effect, the key bottleneck of the GCG optimization. To this end, we propose the Model Attack Gradient Index GCG (MAGIC), that addresses the Indirect Effect by exploiting the gradient information of the suffix tokens, thereby accelerating the procedure by having less computation and fewer iterations. Our experiments on AdvBench show that MAGIC achieves up to a 1.5x speedup, while maintaining Attack Success Rates (ASR) on par or even higher than other baselines. Our MAGIC achieved an ASR of 74% on the Llama-2 and an ASR of 54% when conducting transfer attacks on GPT-3.5. Code is available at https://github.com/jiah-li/magic.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。