提出首个系统化检测大模型越狱漏洞的方法，解决安全评估中的核心难题。
Toward Principled LLM Safety Testing: Solving the Jailbreak Oracle Problem
- 分两阶段搜索：先广度采样找易突破路径，再深度优先用安全分数引导探索
- 在100次尝试内成功触发72%的越狱攻击，显著提升检测效率
- 适合安全研究人员、模型评测团队和需高安全性部署的机构使用
随着大语言模型在安全关键场景中的广泛应用，缺乏系统化的漏洞评估方法导致其面临严重的安全风险。本文提出‘越狱查询问题’：给定模型、提示和解码策略，判断是否存在响应概率超过指定阈值的越狱输出。该形式化为越狱漏洞研究提供了理论基础。求解此问题面临巨大计算挑战，因响应长度增长导致搜索空间呈指数级膨胀。我们提出Boa，首个专为此问题设计的高效系统。Boa采用双阶段搜索策略：（1）通过广度优先采样识别易触发的越狱路径；（2）基于细粒度安全评分，进行深度优先优先搜索，系统探索低概率但有潜力的攻击路径。Boa支持严格的安全部署评估，包括防御机制系统性验证、红队攻击标准化对比，以及极端对抗条件下的模型认证。代码已开源。
原文摘要 · Abstract (English)
As large language models (LLMs) become increasingly deployed in safety-critical applications, the lack of systematic methods to assess their vulnerability to jailbreak attacks presents a critical security gap. We introduce the jailbreak oracle problem: given a model, prompt, and decoding strategy, determine whether a jailbreak response can be generated with likelihood exceeding a specified threshold. This formalization enables a principled study of jailbreak vulnerabilities. Answering the jailbreak oracle problem poses significant computational challenges, as the search space grows exponentially with response length. We present Boa, the first system designed for efficiently solving the jailbreak oracle problem. Boa employs a two-phase search strategy: (1) breadth-first sampling to identify easily accessible jailbreaks, followed by (2) depth-first priority search guided by fine-grained safety scores to systematically explore promising yet low-probability paths. Boa enables rigorous security assessments including systematic defense evaluation, standardized comparison of red team attacks, and model certification under extreme adversarial conditions. Code is available at https://github.com/shuyilinn/BOA/tree/mlsys2026ae
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。