通过分解攻击模式与行为，提升大模型越狱的效率与通用性。
Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning
- 将越狱攻击拆解为模式学习与行为模仿两阶段，提升攻击效率。
- 仅需32个示例即可攻破Llama-3-8B-Instruct，优于现有方法。
- 适合研究大模型安全漏洞或对抗攻击的开发者参考。
近期多项研究探索了使用少量恶意示例对大型语言模型进行越狱攻击。其中，Zheng等提出改进的少样本越狱（I-FSJ）方法，通过在示例中注入特殊标记并采用示例级随机搜索，提升了攻击效率。然而，该方法仍需较长上下文，例如在Meta-Llama-3-8B-Instruct（Llama-3）上需要32个示例才能成功越狱。本文分析了I-FSJ的局限性，提出自指导少样本越狱（Self-Instruct-FSJ），结合示例级贪心搜索，将攻击过程分解为模式学习与行为学习，以更通用、高效的方式挖掘模型漏洞。我们在多个开源模型上进行了详尽实验，并与基线算法对比验证了方法的有效性。代码已公开于https://github.com/iphosi/Self-Instruct-FSJ。
原文摘要 · Abstract (English)
Recently, several works have been conducted on jailbreaking Large Language Models (LLMs) with few-shot malicious demos. In particular, Zheng et al. focus on improving the efficiency of Few-Shot Jailbreaking (FSJ) by injecting special tokens into the demos and employing demo-level random search, known as Improved Few-Shot Jailbreaking (I-FSJ). Nevertheless, we notice that this method may still require a long context to jailbreak advanced models e.g. 32 shots of demos for Meta-Llama-3-8B-Instruct (Llama-3) \cite{llama3modelcard}. In this paper, we discuss the limitations of I-FSJ and propose Self-Instruct Few-Shot Jailbreaking (Self-Instruct-FSJ) facilitated with the demo-level greedy search. This framework decomposes the FSJ attack into pattern and behavior learning to exploit the model's vulnerabilities in a more generalized and efficient way. We conduct elaborate experiments to evaluate our method on common open-source models and compare it with baseline algorithms. Our code is available at https://github.com/iphosi/Self-Instruct-FSJ.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。