提出新方法提升大模型越狱攻击的精准度与自然度
AdvPrefix: An Objective for Nuanced LLM Jailbreaks
- 用双标准自动选择最优越狱前缀，兼顾成功率与流畅性
- 在Llama-3上将攻击成功率从14%提升至80%
- 适用于研究模型安全漏洞或对抗攻击的学者
许多大语言模型越狱攻击依赖统一目标：诱导模型以「Sure, here is (有害请求)」开头回应。该方法虽简单，却存在控制力弱、响应不完整或不自然，且格式僵化难优化的问题。本文提出AdvPrefix，一种即插即用的前缀强制目标，通过结合高预填充攻击成功率和低负对数似然，自动筛选一个或多个模型相关前缀。该方法可无缝融入现有越狱攻击，免费缓解原有缺陷。例如，在Llama-3上替换GCG默认前缀，使细腻越狱成功率从14%提升至80%，揭示当前安全对齐无法泛化至新前缀。代码与选定前缀已开源于github.com/facebookresearch/jailbreak-objectives。
原文摘要 · Abstract (English)
Many jailbreak attacks on large language models (LLMs) rely on a common objective: making the model respond with the prefix ``Sure, here is (harmful request)''. While straightforward, this objective has two limitations: limited control over model behaviors, yielding incomplete or unrealistic jailbroken responses, and a rigid format that hinders optimization. We introduce AdvPrefix, a plug-and-play prefix-forcing objective that selects one or more model-dependent prefixes by combining two criteria: high prefilling attack success rates and low negative log-likelihood. AdvPrefix integrates seamlessly into existing jailbreak attacks to mitigate the previous limitations for free. For example, replacing GCG's default prefixes on Llama-3 improves nuanced attack success rates from 14% to 80%, revealing that current safety alignment fails to generalize to new prefixes. Code and selected prefixes are released at github.com/facebookresearch/jailbreak-objectives.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。