用概率推断生成对抗性提示，一键破解大模型安全限制
VERA: Variational Inference Framework for Jailbreaking Large Language Models
- 将黑盒越狱提示建模为变分推断问题，训练小模型逼近目标模型的后验分布
- 一次训练即可生成多样且流畅的越狱提示，无需对每个问题重新优化
- 适用于评估多类大模型的安全漏洞，适合安全研究与防御开发人员
当前主流大模型仅提供API访问，亟需有效的黑盒越狱方法以识别真实场景下的模型漏洞。现有方法多依赖遗传算法，受限于初始条件和人工提示池，且需针对每条提示单独优化，难以全面刻画模型脆弱性。为此，我们提出VERA：一种用于越狱的大语言模型变分推断框架。VERA将黑盒越狱提示构建视为变分推断问题，训练一个小型攻击者模型以逼近目标模型在对抗性提示上的后验分布。模型训练完成后，可无需重新优化即生成多样、流畅的越狱提示。实验表明，VERA在多种目标大模型上均表现优异，凸显了概率推断在对抗提示生成中的价值。
原文摘要 · Abstract (English)
The rise of API-only access to state-of-the-art LLMs highlights the need for effective black-box jailbreak methods to identify model vulnerabilities in real-world settings. Without a principled objective for gradient-based optimization, most existing approaches rely on genetic algorithms, which are limited by their initialization and dependence on manually curated prompt pools. Furthermore, these methods require individual optimization for each prompt, failing to provide a comprehensive characterization of model vulnerabilities. To address this gap, we introduce VERA: Variational infErence fRamework for jAilbreaking. VERA casts black-box jailbreak prompting as a variational inference problem, training a small attacker LLM to approximate the target LLM's posterior over adversarial prompts. Once trained, the attacker can generate diverse, fluent jailbreak prompts for a target query without re-optimization. Experimental results show that VERA achieves strong performance across a range of target LLMs, highlighting the value of probabilistic inference for adversarial prompt generation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。