改进大模型对抗攻击方法，提升真实攻击成功率。
REINFORCE Adversarial Attacks on Large Language Models: An Adaptive, Distributional, and Semantic Objective
- 基于REINFORCE的分布优化，自适应调整攻击目标。
- 在Llama3上使攻击成功率翻倍，防御下从2%升至50%。
- 更贴近模型输出分布，适合研究安全与攻防的学者。
为绕过大语言模型（LLMs）的对齐机制，现有基于优化的对抗攻击通常通过最大化特定正面回应的概率来构造对抗提示。然而，即使正面回应概率高，模型仍常未生成有害内容。此外，该正面目标未适配模型偏好，且忽略了LLM输出是响应分布的事实。若以此类低成功率衡量鲁棒性，可能严重高估真实防护能力。为此，我们提出一种针对响应群体的自适应语义优化问题，通过REINFORCE策略梯度框架推导出通用目标，并在最先进的越狱算法GCG和PGD中验证其有效性。例如，该方法使Llama3上的攻击成功率（ASR）翻倍，并在电路断路器防御下将ASR从2%提升至50%。
原文摘要 · Abstract (English)
To circumvent the alignment of large language models (LLMs), current optimization-based adversarial attacks usually craft adversarial prompts by maximizing the likelihood of a so-called affirmative response. An affirmative response is a manually designed start of a harmful answer to an inappropriate request. While it is often easy to craft prompts that yield a substantial likelihood for the affirmative response, the attacked model frequently does not complete the response in a harmful manner. Moreover, the affirmative objective is usually not adapted to model-specific preferences and essentially ignores the fact that LLMs output a distribution over responses. If low attack success under such an objective is taken as a measure of robustness, the true robustness might be grossly overestimated. To alleviate these flaws, we propose an adaptive and semantic optimization problem over the population of responses. We derive a generally applicable objective via the REINFORCE policy-gradient formalism and demonstrate its efficacy with the state-of-the-art jailbreak algorithms Greedy Coordinate Gradient (GCG) and Projected Gradient Descent (PGD). For example, our objective doubles the attack success rate (ASR) on Llama3 and increases the ASR from 2% to 50% with circuit breaker defense.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。