用中间回复诱导大模型生成违规内容，攻击成功率显著提升。
Response Attack: Exploiting Contextual Priming to Jailbreak Large Language Models
- 利用对话中温和有害的中间回复作为上下文提示
- 在8个主流大模型上攻击成功率超9个基线方法
- 隐蔽性强、效率高，适合研究安全漏洞与对抗攻击
上下文引导效应（contextual priming）——早期刺激隐性影响后续判断——为大语言模型（LLMs）提供了未被探索的攻击面。我们发现一种新型漏洞：对话中的前一回复可引导模型后续生成违反政策的内容。现有越狱攻击多依赖单轮或多轮提示操纵或静态上下文示例，存在效果有限、效率低或语义漂移问题。本文提出响应攻击（Response Attack, RA），通过在目标触发提示前注入经过策略设计的中间、轻微有害回复，作为上下文引导。实验覆盖8个前沿大模型，结果表明RA在攻击成功率上显著优于9个主流基线方法。成功归因于中间回复的策略性使用，能促使模型生成更直接、相关的有害内容，同时保持隐蔽性、效率与原始查询一致性。代码与数据已开源。
原文摘要 · Abstract (English)
Contextual priming, where earlier stimuli covertly bias later judgments, offers an unexplored attack surface for large language models (LLMs). We uncover a contextual priming vulnerability in which the previous response in the dialogue can steer its subsequent behavior toward policy-violating content. While existing jailbreak attacks largely rely on single-turn or multi-turn prompt manipulations, or inject static in-context examples, these methods suffer from limited effectiveness, inefficiency, or semantic drift. We introduce Response Attack (RA), a novel framework that strategically leverages intermediate, mildly harmful responses as contextual primers within a dialogue. By reformulating harmful queries and injecting these intermediate responses before issuing a targeted trigger prompt, RA exploits a previously overlooked vulnerability in LLMs. Extensive experiments across eight state-of-the-art LLMs show that RA consistently achieves significantly higher attack success rates than nine leading jailbreak baselines. Our results demonstrate that the success of RA is directly attributable to the strategic use of intermediate responses, which induce models to generate more explicit and relevant harmful content while maintaining stealth, efficiency, and fidelity to the original query. The code and data are available at https://github.com/Dtc7w3PQ/Response-Attack.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。