通过测试时扩展提升模型越狱攻击效果，最高成功率提升15.6个百分点。
AutoDAN-Reasoning: Enhancing Strategies Exploration based Jailbreak Attacks with Test-Time Scaling
- 引入Best-of-N和束搜索两种测试时扩展方法，增强策略探索能力。
- 在Llama-3.1-70B-Instruct上使成功率提升15.6个百分点，对GPT-o4-mini相对提升近60%。
- 适合研究大模型安全、越狱攻击与防御的学者及从业者参考。
近期的越狱攻击方法如AutoDAN-Turbo展示了自动化策略发现的强大能力。该方法通过持续学习智能体从零构建丰富的攻击策略库。然而，其测试时生成过程仅采样一个策略并生成单个攻击提示，未能充分挖掘已学策略库的潜力。本文提出通过测试时扩展进一步提升AutoDAN-Turbo的攻击性能。引入两种不同扩展方法：Best-of-N从采样策略生成N个候选提示并由评分模型选择最优；束搜索则通过组合策略库中的多种策略，探索更强大且具有协同效应的攻击向量。实验表明，所提方法显著提升攻击表现，在Llama-3.1-70B-Instruct上成功率最高提升15.6个百分点，并在高度鲁棒的GPT-o4-mini上实现接近60%的相对改进。
原文摘要 · Abstract (English)
Recent advancements in jailbreaking large language models (LLMs), such as AutoDAN-Turbo, have demonstrated the power of automated strategy discovery. AutoDAN-Turbo employs a lifelong learning agent to build a rich library of attack strategies from scratch. While highly effective, its test-time generation process involves sampling a strategy and generating a single corresponding attack prompt, which may not fully exploit the potential of the learned strategy library. In this paper, we propose to further improve the attack performance of AutoDAN-Turbo through test-time scaling. We introduce two distinct scaling methods: Best-of-N and Beam Search. The Best-of-N method generates N candidate attack prompts from a sampled strategy and selects the most effective one based on a scorer model. The Beam Search method conducts a more exhaustive search by exploring combinations of strategies from the library to discover more potent and synergistic attack vectors. According to the experiments, the proposed methods significantly boost performance, with Beam Search increasing the attack success rate by up to 15.6 percentage points on Llama-3.1-70B-Instruct and achieving a nearly 60% relative improvement against the highly robust GPT-o4-mini compared to the vanilla method.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。