用文字谜题绕过大模型安全检测，成功率高达88.8%
PUZZLED: Jailbreaking LLMs through Word-Based Puzzles
- 将有害指令关键词伪装成字谜，诱使模型自行解码
- 在5个主流大模型上平均攻击成功率达88.8%，GPT-4.1达96.5%
- 适合研究模型安全与对抗攻击的学者使用
随着大语言模型（LLMs）在多个领域广泛应用，其安全性成为关键问题。现有攻击方法多依赖迭代提示工程或语义转换以规避检测。本文提出PUZZLED，一种利用模型推理能力的新颖越狱方法：将有害指令中的关键词掩码，并以文字谜题形式呈现给模型求解。设计了字搜索、变位词和填字三种对人类熟悉但对模型认知负担重的谜题类型。模型需解谜还原原始指令后才可生成响应。在五个先进LLM上测试，平均攻击成功率达88.8%，其中GPT-4.1为96.5%，Claude 3.7 Sonnet为92.3%。该方法简单有效，通过调动模型推理能力将常见谜题转化为高效越狱策略。
原文摘要 · Abstract (English)
As large language models (LLMs) are increasingly deployed across diverse domains, ensuring their safety has become a critical concern. In response, studies on jailbreak attacks have been actively growing. Existing approaches typically rely on iterative prompt engineering or semantic transformations of harmful instructions to evade detection. In this work, we introduce PUZZLED, a novel jailbreak method that leverages the LLM's reasoning capabilities. It masks keywords in a harmful instruction and presents them as word puzzles for the LLM to solve. We design three puzzle types-word search, anagram, and crossword-that are familiar to humans but cognitively demanding for LLMs. The model must solve the puzzle to uncover the masked words and then proceed to generate responses to the reconstructed harmful instruction. We evaluate PUZZLED on five state-of-the-art LLMs and observe a high average attack success rate (ASR) of 88.8%, specifically 96.5% on GPT-4.1 and 92.3% on Claude 3.7 Sonnet. PUZZLED is a simple yet powerful attack that transforms familiar puzzles into an effective jailbreak strategy by harnessing LLMs' reasoning capabilities.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。