通过提取模型中的合规方向，提升越狱攻击成功率。
Jailbreak Attack Initializations as Extractors of Compliance Directions
- 利用梯度攻击收敛到单一合规方向，揭示其内在机制
- 新方法在多个模型上将攻击成功率提升，计算开销更低
- 适合研究大模型安全漏洞或对抗攻击的开发者
安全对齐的大语言模型对提示词的响应分为合规或拒绝，分别对应模型激活空间中的不同方向。近期研究表明，通过自迁移方式从其他提示词初始化攻击可显著提升性能，但其底层机制仍不清晰，且初始值常为随意或手动选择。本文发现，每轮基于梯度的越狱攻击及其后续初始化会逐渐收敛至一个抑制拒绝的单一合规方向，从而实现从拒绝到合规的高效转换。基于此，我们提出CRI框架，旨在将未见提示词投影至更远的合规方向。我们在多个攻击方法、模型和数据集上验证该方法，实现了更高的攻击成功率（ASR）并降低计算开销，凸显了安全对齐大模型的脆弱性。参考实现详见：https://amit1221levi.github.io/CRI-Jailbreak-Init-LLMs-evaluation。
原文摘要 · Abstract (English)
Safety-aligned LLMs respond to prompts with either compliance or refusal, each corresponding to distinct directions in the model's activation space. Recent works show that initializing attacks via self-transfer from other prompts significantly enhances their performance. However, the underlying mechanisms of these initializations remain unclear, and attacks utilize arbitrary or hand-picked initializations. This work presents that each gradient-based jailbreak attack and subsequent initialization gradually converge to a single compliance direction that suppresses refusal, thereby enabling an efficient transition from refusal to compliance. Based on this insight, we propose CRI, an initialization framework that aims to project unseen prompts further along compliance directions. We demonstrate our approach on multiple attacks, models, and datasets, achieving an increased attack success rate (ASR) and reduced computational overhead, highlighting the fragility of safety-aligned LLMs. A reference implementation is available at: https://amit1221levi.github.io/CRI-Jailbreak-Init-LLMs-evaluation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。