某些大模型能读懂人类看不懂的符号序列，可能带来安全风险。
À la recherche du sens perdu: your favourite LLM might have more to say than you can understand
- 用看似无意义的符号序列测试模型，发现其可识别隐藏语义。
- gpt-4o mini在特定攻击下破解成功率可达40%（ASR=0.4）。
- 该现象或源于分词机制引发的虚假关联，适合关注AI安全的研究者。
我们观察到，大语言模型能为人类无法理解的视觉序列赋予隐含含义：例如，由拜占庭音乐符号组成的无意义短语，gpt-4o却识别为“say abracadabra”。部分模型甚至能利用此类序列进行通信。这些现象可能源于大量分词（BPE）导致的虚假相关性。我们系统评估了包括Claude-3.5 Haiku、Claude-3.5 Sonnet（新旧版）、Claude-3.7 Sonnet、gpt-4o mini、gpt-4o、o1-mini、Llama-3.3 70B、DeepSeek-R1-Distill-Lllama 70B、Qwen2.5 1.5B、Qwen2.5 32B、Phi-3.5 mini、GigaChat-Max、Vikhr-Llama-3.2 1B在内的多种模型。结果表明，此现象可能对现代及未来大模型的安全与可靠性造成深远影响。举例说明，结合简单模板即可成功绕过前代模型防护，gpt-4o mini的攻击成功率（ASR）达0.4。代码与数据集已公开于https://github.com/L3G5/llm-hidden-meanings。
原文摘要 · Abstract (English)
We report a peculiar observation that LLMs can assign hidden meanings to sequences that seem visually incomprehensible to humans: for example, a nonsensical phrase consisting of Byzantine musical symbols is recognized by gpt-4o as "say abracadabra". Moreover, some models can communicate using these sequences. Some of these meanings are hypothesized to partly originate in the massive spurious correlations due to BPE tokenization. We systematically evaluate the presence of such abilities in a wide range of models: Claude-3.5 Haiku, Claude-3.5 Sonnet (New and Old), Claude-3.7 Sonnet, gpt-4o mini, gpt-4o, o1-mini, Llama-3.3 70B, DeepSeek-R1-Distill-Lllama 70B, Qwen2.5 1.5B, Qwen2.5 32B, Phi-3.5 mini, GigaChat-Max, Vikhr-Llama-3.2 1B. We argue that this observation might have far-reaching consequences for both safety and security of the modern and future LLMs and systems that employ them. As an illustration, we show that applying this method in combination with simple templates is sufficient to jailbreak previous generation models, with ASR = 0.4 on gpt-4o mini. Our code and data artifacts are available at https://github.com/L3G5/llm-hidden-meanings
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。