通过分析模型输出概率，用小插件实现对API调用大模型的越狱攻击。
JULI: Jailbreak Large Language Models by Self-Introspection
- 仅需目标模型预测的前5个词元概率，通过小模块BiasNet操控生成结果。
- 在黑盒环境下成功越狱多个主流API调用的大模型，效果优于现有方法。
- 适合研究模型安全漏洞或对抗攻击的开发者快速验证系统弱点。
大型语言模型（LLMs）经过安全对齐训练，以避免生成恶意内容。尽管已有攻击揭示了这些安全对齐模型的漏洞，但通常存在局限性，例如需要访问模型权重或生成过程。由于通过API调用的专有模型不提供此类权限，这类攻击难以对其造成影响。本文提出一种名为JULI（Jailbreaking Using LLM Introspection）的新方法，通过操纵词元日志概率，利用一个微型插件模块BiasNet实现越狱。JULI仅依赖目标模型预测的词元日志概率，可在黑盒设置下，仅知前5个候选词元的概率时，有效突破API调用模型的安全防护。实验表明，该方法在多个指标上均优于现有最先进（SOTA）技术。
原文摘要 · Abstract (English)
Large Language Models (LLMs) are trained with safety alignment to prevent generating malicious content. Although some attacks have highlighted vulnerabilities in these safety-aligned LLMs, they typically have limitations, such as necessitating access to the model weights or the generation process. Since proprietary models through API-calling do not grant users such permissions, these attacks find it challenging to compromise them. In this paper, we propose Jailbreaking Using LLM Introspection (JULI), which jailbreaks LLMs by manipulating the token log probabilities, using a tiny plug-in block, BiasNet. JULI relies solely on the knowledge of the target LLM's predicted token log probabilities. It can effectively jailbreak API-calling LLMs under a black-box setting and knowing only top-$5$ token log probabilities. Our approach demonstrates superior effectiveness, outperforming existing state-of-the-art (SOTA) approaches across multiple metrics.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。