通过分段分布式处理绕过大模型安全过滤，生成恶意代码成功率73.2%。
Prompt, Divide, and Conquer: Bypassing Large Language Model Safety Filters via Segmented and Distributed Prompt Processing
- 将提示词分段并并行处理，再聚合结果以规避安全检测。
- 在10类网络安全任务中达成73.2%的恶意代码生成成功率。
- 使用多LLM评审系统更真实评估攻击效果，避免误判。
大型语言模型（LLMs）在多个领域推动了任务自动化与内容生成，同时引入安全过滤机制防止滥用。本文提出一种新型越狱框架，结合分布式提示处理与迭代优化，突破安全限制，尤其针对恶意代码生成。该架构包含四个核心模块：提示分割、并行处理、响应聚合及基于LLM的评委评估。在涵盖10个网络安全类别的500个恶意提示上测试，该框架实现73.2%的成功率（SR）。对比分析显示，传统单模型评委评估高估了成功率（93.8%），而本研究的多模型评委系统更为准确；手动验证表明，单评委常接受不完整实现。此外，消融实验显示，分布式架构相比非分布式方法提升12%成功率，凸显分布式处理的有效性与严谨评估方法的重要性。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have transformed task automation and content generation across various domains while incorporating safety filters to prevent misuse. We introduce a novel jailbreaking framework that employs distributed prompt processing combined with iterative refinements to bypass these safety measures, particularly in generating malicious code. Our architecture consists of four key modules: prompt segmentation, parallel processing, response aggregation, and LLM-based jury evaluation. Tested on 500 malicious prompts across 10 cybersecurity categories, the framework achieves a 73.2% Success Rate (SR) in generating malicious code. Notably, our comparative analysis reveals that traditional single-LLM judge evaluation overestimates SRs (93.8%) compared to our LLM jury system (73.2%), with manual verification confirming that single-judge assessments often accept incomplete implementations. Moreover, we demonstrate that our distributed architecture improves SRs by 12% over the non-distributed approach in an ablation study, highlighting both the effectiveness of distributed prompt processing and the importance of robust evaluation methodologies in assessing jailbreak attempts.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。