多轮越狱攻击其实没那么复杂，反复试单轮攻击就能奏效。
Multi-Turn Jailbreaks Are Simpler Than They Seem
- 通过多次尝试单轮攻击，可逼近多轮攻击效果。
- 对齐模型成功率超70%，新模型易被已知攻击突破。
- 推理越深入的模型反而越容易被攻破，反直觉。
尽管针对大语言模型（LLMs）单轮越狱攻击的防御已显著提升，多轮越狱攻击仍是持续存在的漏洞，常在优化过单轮防护的模型上取得超过70%的成功率。本文基于StrongREJECT基准，对GPT-4、Claude和Gemini等先进模型进行了自动化多轮越狱攻击的实证分析。结果表明：当攻击者能从模型拒绝有害请求的方式中学习时，多轮攻击本质上与多次重试单轮攻击相当。此外，相似模型间攻击成功率存在相关性，使得新发布模型更易被攻破。尤其对推理类模型，我们发现更高的推理努力反而导致更高的攻击成功率，这一现象出人意料。研究对AI安全评估与抗越狱系统设计具有重要启示。代码已开源：https://github.com/diogo-cruz/multi_turn_simpler。
原文摘要 · Abstract (English)
While defenses against single-turn jailbreak attacks on Large Language Models (LLMs) have improved significantly, multi-turn jailbreaks remain a persistent vulnerability, often achieving success rates exceeding 70% against models optimized for single-turn protection. This work presents an empirical analysis of automated multi-turn jailbreak attacks across state-of-the-art models including GPT-4, Claude, and Gemini variants, using the StrongREJECT benchmark. Our findings challenge the perceived sophistication of multi-turn attacks: when accounting for the attacker's ability to learn from how models refuse harmful requests, multi-turn jailbreaking approaches are approximately equivalent to simply resampling single-turn attacks multiple times. Moreover, attack success is correlated among similar models, making it easier to jailbreak newly released ones. Additionally, for reasoning models, we find surprisingly that higher reasoning effort often leads to higher attack success rates. Our results have important implications for AI safety evaluation and the design of jailbreak-resistant systems. We release the source code at https://github.com/diogo-cruz/multi_turn_simpler
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。