arXiv:2506.07596cs.LG2025-06被引 21

通过孪生提示识别并移除大模型安全机制,实现高效越狱。

TwinBreak: Jailbreaking LLM Security Alignments based on Twin Prompts

  • 基于结构相似的孪生提示分析中间输出,定位安全参数。
  • 在16个大模型上达成89%~98%越狱成功率,计算开销极低。
  • 适合研究模型安全漏洞与对抗攻击的学者使用。

机器学习快速发展,大语言模型(LLMs)如ChatGPT已广泛应用于翻译、代码生成等场景。然而,其也带来社会风险,恶意用户可通过有害提示诱导模型生成非法内容。为应对,模型常内置安全机制自动拒绝此类请求,但易被越狱攻击绕过。现有方法往往依赖大量人工或高算力,且可能损害模型正常功能。本文提出TwinBreak,首次通过分析具有高度结构与内容相似性的孪生提示的中间输出,精准定位并剪枝负责安全对齐的模型参数。该方法聚焦关键层,实现细粒度分析,同时保留模型核心能力。我们构建了包含100组孪生提示的TwinPrompt数据集。实验表明,TwinBreak在5家厂商的16个模型上均达到89%至98%的越狱成功率,且计算成本极低。

原文摘要 · Abstract (English)

Machine learning is advancing rapidly, with applications bringing notable benefits, such as improvements in translation and code generation. Models like ChatGPT, powered by Large Language Models (LLMs), are increasingly integrated into daily life. However, alongside these benefits, LLMs also introduce social risks. Malicious users can exploit LLMs by submitting harmful prompts, such as requesting instructions for illegal activities. To mitigate this, models often include a security mechanism that automatically rejects such harmful prompts. However, they can be bypassed through LLM jailbreaks. Current jailbreaks often require significant manual effort, high computational costs, or result in excessive model modifications that may degrade regular utility. We introduce TwinBreak, an innovative safety alignment removal method. Building on the idea that the safety mechanism operates like an embedded backdoor, TwinBreak identifies and prunes parameters responsible for this functionality. By focusing on the most relevant model layers, TwinBreak performs fine-grained analysis of parameters essential to model utility and safety. TwinBreak is the first method to analyze intermediate outputs from prompts with high structural and content similarity to isolate safety parameters. We present the TwinPrompt dataset containing 100 such twin prompts. Experiments confirm TwinBreak's effectiveness, achieving 89% to 98% success rates with minimal computational requirements across 16 LLMs from five vendors.

大模型安全越狱攻击参数剪枝

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。