用隐形符号劫持大模型，让恶意指令看不见却有效。
Imperceptible Jailbreaking against Large Language Models
- 用不可见的变体选择符悄悄修改提示词
- 对4个对齐大模型攻击成功率超90%
- 适合研究安全漏洞或对抗样本的读者
针对视觉模态的越狱攻击通常依赖不可察觉的对抗扰动，而文本模态的攻击则普遍被认为需可见修改（如非语义后缀）。本文提出一种利用称为变体选择符（variation selectors）的不可见Unicode字符实现的隐形越狱。通过在恶意问题末尾添加这些字符，使越狱提示在屏幕上显示与原问题完全一致，但其分词结果被“秘密”改变。我们设计了一条搜索链生成此类对抗性后缀，以诱导有害响应。实验表明，该方法在四个对齐的大语言模型上均达到高攻击成功率，并能泛化至提示注入攻击，且书面提示中无任何可见修改。代码已开源：https://github.com/sail-sg/imperceptible-jailbreaks。
原文摘要 · Abstract (English)
Jailbreaking attacks on the vision modality typically rely on imperceptible adversarial perturbations, whereas attacks on the textual modality are generally assumed to require visible modifications (e.g., non-semantic suffixes). In this paper, we introduce imperceptible jailbreaks that exploit a class of Unicode characters called variation selectors. By appending invisible variation selectors to malicious questions, the jailbreak prompts appear visually identical to original malicious questions on screen, while their tokenization is "secretly" altered. We propose a chain-of-search pipeline to generate such adversarial suffixes to induce harmful responses. Our experiments show that our imperceptible jailbreaks achieve high attack success rates against four aligned LLMs and generalize to prompt injection attacks, all without producing any visible modifications in the written prompt. Our code is available at https://github.com/sail-sg/imperceptible-jailbreaks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。