利用对话历史劫持大模型，让其生成违规内容
Dialogue Injection Attack: Jailbreaking LLMs through Context Manipulation
- 通过构造恶意对话历史提升攻击成功率
- 在Llama-3.1和GPT-4o上达到顶尖攻击效果
- 可绕过5种防御机制，适合安全研究者参考
大型语言模型（LLMs）在诸多应用中展现出巨大价值，但其部署面临安全漏洞，尤其是越狱攻击。此类攻击通过设计对抗性提示，诱使模型生成有害或不道德内容。现有研究多聚焦单轮交互，忽视了对话历史对模型行为的影响。本文提出新型越狱范式——对话注入攻击（Dialogue Injection Attack, DIA），利用对话历史提升攻击成功率。DIA为黑盒设置，仅需访问聊天API或了解模型聊天模板。我们提出两种构建对抗性历史对话的方法：一种适配灰盒预填充攻击，另一种利用延迟响应。实验表明，DIA在近期LLM如Llama-3.1和GPT-4o上达到当前最佳攻击成功率，并能绕过5种不同防御机制，凸显其鲁棒性与有效性。
原文摘要 · Abstract (English)
Large language models (LLMs) have demonstrated significant utility in a wide range of applications; however, their deployment is plagued by security vulnerabilities, notably jailbreak attacks. These attacks manipulate LLMs to generate harmful or unethical content by crafting adversarial prompts. While much of the current research on jailbreak attacks has focused on single-turn interactions, it has largely overlooked the impact of historical dialogues on model behavior. In this paper, we introduce a novel jailbreak paradigm, Dialogue Injection Attack (DIA), which leverages the dialogue history to enhance the success rates of such attacks. DIA operates in a black-box setting, requiring only access to the chat API or knowledge of the LLM's chat template. We propose two methods for constructing adversarial historical dialogues: one adapts gray-box prefilling attacks, and the other exploits deferred responses. Our experiments show that DIA achieves state-of-the-art attack success rates on recent LLMs, including Llama-3.1 and GPT-4o. Additionally, we demonstrate that DIA can bypass 5 different defense mechanisms, highlighting its robustness and effectiveness.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。