通过优化隐空间生成高成功率越狱提示，突破语言离散性限制。
LARGO: Latent Adversarial Reflection through Gradient Optimization for Jailbreaking LLMs
- 在连续隐空间中优化对抗向量，再用同一模型解码为自然语言。
- 在AdvBench上比AutoDAN高出44分攻击成功率，且提示更流畅隐蔽。
- 适合研究模型安全与越狱攻击的开发者，尤其关注梯度优化应用。
高效红队测试方法对发现大语言模型（LLMs）漏洞至关重要。尽管近期攻击常使用LLM作为优化器，但离散的语言空间使基于梯度的方法难以奏效。我们提出LARGO（Latent Adversarial Reflection through Gradient Optimization），一种新型隐空间自反思攻击方法，重新发挥梯度优化在生成流畅越狱提示中的优势。LARGO在LLM的连续隐空间中先优化对抗性隐向量，再递归调用相同模型将隐向量解码为自然语言。该方法快速、有效且具备迁移性，生成的提示流畅且隐蔽。在AdvBench和JailbreakBench等标准基准上，LARGO的攻击成功率较AutoDAN等领先技术高出44分。研究结果表明，通过梯度优化解析并攻击LLM内部机制，是替代代理式LLM提示的一种强效方案。
原文摘要 · Abstract (English)
Efficient red-teaming method to uncover vulnerabilities in Large Language Models (LLMs) is crucial. While recent attacks often use LLMs as optimizers, the discrete language space make gradient-based methods struggle. We introduce LARGO (Latent Adversarial Reflection through Gradient Optimization), a novel latent self-reflection attack that reasserts the power of gradient-based optimization for generating fluent jailbreaking prompts. By operating within the LLM's continuous latent space, LARGO first optimizes an adversarial latent vector and then recursively call the same LLM to decode the latent into natural language. This methodology yields a fast, effective, and transferable attack that produces fluent and stealthy prompts. On standard benchmarks like AdvBench and JailbreakBench, LARGO surpasses leading jailbreaking techniques, including AutoDAN, by 44 points in attack success rate. Our findings demonstrate a potent alternative to agentic LLM prompting, highlighting the efficacy of interpreting and attacking LLM internals through gradient optimization.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。