通过迭代语义优化，低成本突破黑盒大模型安全限制。
MIST: Jailbreaking Black-box Large Language Models via Iterative Semantic Tuning
- 用语义保持的词替换和顺序优化逐步生成越狱提示。
- 在多个模型上实现高成功率，仅需少量查询次数。
- 适合研究模型安全漏洞或防御机制的开发者参考。
尽管大型语言模型（LLMs）已尽力对齐社会与道德价值，仍易受越狱攻击——旨在诱使模型生成有害内容的方法。由于输入为离散分词、目标模型不可见且查询预算有限，攻击黑盒LLM极具挑战。为此，我们提出一种名为MIST的有效方法，通过迭代语义调优实现对黑盒大模型的越狱。MIST可逐次优化提示，保持原始语义意图的同时诱导出有害内容。具体而言，为平衡语义相似性与计算效率，MIST采用两项关键策略：序列同义词搜索及其进阶版本——顺序决定优化。我们在两个数据集上，使用两个开源及四个闭源模型进行了广泛实验。结果表明，MIST在攻击成功率、查询次数与迁移能力方面均表现优异，优于或匹配现有最先进越狱方法。此外，我们还分析了计算效率，验证了MIST的实际可行性。
原文摘要 · Abstract (English)
Despite efforts to align large language models (LLMs) with societal and moral values, these models remain susceptible to jailbreak attacks -- methods designed to elicit harmful responses. Jailbreaking black-box LLMs is considered challenging due to the discrete nature of token inputs, restricted access to the target LLM, and limited query budget. To address the issues above, we propose an effective method for jailbreaking black-box large language Models via Iterative Semantic Tuning, named MIST. MIST enables attackers to iteratively refine prompts that preserve the original semantic intent while inducing harmful content. Specifically, to balance semantic similarity with computational efficiency, MIST incorporates two key strategies: sequential synonym search, and its advanced version -- order-determining optimization. We conduct extensive experiments on two datasets using two open-source and four closed-source models. Results show that MIST achieves competitive attack success rate, relatively low query count, and fair transferability, outperforming or matching state-of-the-art jailbreak methods. Additionally, we conduct analysis on computational efficiency to validate the practical viability of MIST.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。