通过最大化提示语义差异实现高效越狱，成功率高达94%。
Alphabet Index Mapping: Jailbreaking LLMs through Semantic Dissimilarity
- 利用字母索引映射生成语义迥异但可解码的提示
- 在GPT-4上实现94%越狱成功率，优于现有方法
- 揭示语义差异与越狱成功的关系，适合安全研究者
大型语言模型虽能力强大，但易受越狱攻击威胁。现有方法多存在计算成本高、令牌消耗大或解码复杂等问题。本文分析FlipAttack的有效机制，发现原始提示与修改后提示的语义差异越大，越狱成功率（ASR）越高。为此提出新攻击方法Alphabet Index Mapping（AIM），在保持简单解码的同时最大化语义差异。在AdvBench子集上的实验表明，AIM及变体AIM+FWO在GPT-4上达到94%的ASR，优于FlipAttack及其他方法。结果表明，语义差异虽关键，但需与解码简便性平衡，才能实现高效越狱。本工作深化了对对抗提示机制的理解，并提供了一种有效的新越狱技术。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have demonstrated remarkable capabilities, yet their susceptibility to adversarial attacks, particularly jailbreaking, poses significant safety and ethical concerns. While numerous jailbreak methods exist, many suffer from computational expense, high token usage, or complex decoding schemes. Liu et al. (2024) introduced FlipAttack, a black-box method that achieves high attack success rates (ASR) through simple prompt manipulation. This paper investigates the underlying mechanisms of FlipAttack's effectiveness by analyzing the semantic changes induced by its flipping modes. We hypothesize that semantic dissimilarity between original and manipulated prompts is inversely correlated with ASR. To test this, we examine embedding space visualizations (UMAP, KDE) and cosine similarities for FlipAttack's modes. Furthermore, we introduce a novel adversarial attack, Alphabet Index Mapping (AIM), designed to maximize semantic dissimilarity while maintaining simple decodability. Experiments on GPT-4 using a subset of AdvBench show AIM and its variant AIM+FWO achieve a 94% ASR, outperforming FlipAttack and other methods on this subset. Our findings suggest that while high semantic dissimilarity is crucial, a balance with decoding simplicity is key for successful jailbreaking. This work contributes to a deeper understanding of adversarial prompt mechanics and offers a new, effective jailbreak technique.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。