arXiv:2505.21277cs.CRcs.AI2025-05ACL被引 25

通过扩展攻击策略空间,实现对大模型的高效越狱突破。

Breaking the Ceiling: Exploring the Potential of Jailbreak Attacks through Expanding Strategy Space

  • 基于ELM理论分解攻击策略,用遗传算法优化并评估意图。
  • 在Claude-3.5上达成90%以上越狱成功率,此前方法完全失效。
  • 代码开源,适合安全研究者与对抗攻击方向人员参考。

大型语言模型尽管具备强大通用能力,仍面临诸多安全风险,尤其是可绕过安全协议的越狱攻击。通过黑盒越狱攻击理解这些漏洞,更贴近真实场景,有助于评估模型鲁棒性。现有方法虽通过提示工程提升效果,但在对齐安全策略的模型上仍受限,根源在于预设策略空间的固有边界。拓展策略空间虽具潜力,却面临如何系统捕获关键攻击模式及高效应对复杂性的挑战。为此,本文提出新框架:基于埃尔伯特可能性模型(ELM)将越狱策略分解为基本组件,并引入带意图评估机制的遗传优化算法。实验表明,该方法显著提升越狱能力——在Claude-3.5上成功率达90%以上,远超此前方法;同时具备强跨模型迁移性,并在评估准确率上超越专用防护模型。代码已开源:https://github.com/Aries-iai/CL-GSO。

原文摘要 · Abstract (English)

Large Language Models (LLMs), despite advanced general capabilities, still suffer from numerous safety risks, especially jailbreak attacks that bypass safety protocols. Understanding these vulnerabilities through black-box jailbreak attacks, which better reflect real-world scenarios, offers critical insights into model robustness. While existing methods have shown improvements through various prompt engineering techniques, their success remains limited against safety-aligned models, overlooking a more fundamental problem: the effectiveness is inherently bounded by the predefined strategy spaces. However, expanding this space presents significant challenges in both systematically capturing essential attack patterns and efficiently navigating the increased complexity. To better explore the potential of expanding the strategy space, we address these challenges through a novel framework that decomposes jailbreak strategies into essential components based on the Elaboration Likelihood Model (ELM) theory and develops genetic-based optimization with intention evaluation mechanisms. To be striking, our experiments reveal unprecedented jailbreak capabilities by expanding the strategy space: we achieve over 90% success rate on Claude-3.5 where prior methods completely fail, while demonstrating strong cross-model transferability and surpassing specialized safeguard models in evaluation accuracy. The code is open-sourced at: https://github.com/Aries-iai/CL-GSO.

越狱攻击LLM安全遗传算法策略空间

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。