用更优目标函数，仅需一次交互就能高效生成通用越狱后缀。
A Closer Look at Adversarial Suffix Learning for Jailbreaking LLMs: Augmented Adversarial Trigger Learning
- 设计加权损失函数，让触发词更聚焦于响应格式标记。
- 单次交互即可成功越狱，成功率接近100%，查询次数减少80%。
- 可提取隐藏系统指令，且对新模型和未见查询有强泛化能力。
基于梯度的对抗攻击方法可自动学习对抗性触发词以生成越狱提示或泄露系统指令。本文深入分析了对抗触发词学习的目标函数，提出ATLA：带有增强目标的对抗触发学习。将以往研究使用的负对数似然损失改进为加权损失形式，促使学习到的对抗触发词更优化于响应格式标记。这使得ATLA仅需一个查询-响应对即可学习出有效的对抗触发词，并在相似查询上表现出良好泛化能力。进一步设计了一种辅助损失，抑制逃避性回应。展示了如何使用ATLA学习对抗后缀实现大模型越狱及提取隐藏系统提示。实验证明，ATLA持续优于现有最先进方法，在攻击成功率接近100%的同时，查询次数减少80%。所学越狱后缀对未见查询具有高泛化性，且能有效迁移至新大模型。代码已开源：https://github.com/QData/ALTA_Augmented_Adversarial_Trigger_Learning。
原文摘要 · Abstract (English)
Gradient optimization-based adversarial attack methods automate the learning of adversarial triggers to generate jailbreak prompts or leak system prompts. In this work, we take a closer look at the optimization objective of adversarial trigger learning and propose ATLA: Adversarial Trigger Learning with Augmented objectives. ATLA improves the negative log-likelihood loss used by previous studies into a weighted loss formulation that encourages the learned adversarial triggers to optimize more towards response format tokens. This enables ATLA to learn an adversarial trigger from just one query-response pair and the learned trigger generalizes well to other similar queries. We further design a variation to augment trigger optimization with an auxiliary loss that suppresses evasive responses. We showcase how to use ATLA to learn adversarial suffixes jailbreaking LLMs and to extract hidden system prompts. Empirically we demonstrate that ATLA consistently outperforms current state-of-the-art techniques, achieving nearly 100% success in attacking while requiring 80% fewer queries. ATLA learned jailbreak suffixes demonstrate high generalization to unseen queries and transfer well to new LLMs. We released our code https://github.com/QData/ALTA_Augmented_Adversarial_Trigger_Learning
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。