用诱饵对话主动识别多轮越狱攻击，既防坏人又不误伤好人。
Active Honeypot Guardrail System: Probing and Confirming Multi-Turn LLM Jailbreaks
- 训练诱饵模型生成看似合理实则无害的回应，引出恶意意图
- 在多轮对话中成功将越狱成功率降低72%，同时保持正常用户体验
- 适合需要高安全性又怕误伤的AI应用开发者
大型语言模型日益面临多轮越狱攻击威胁，攻击者通过迭代交互绕过单轮安全过滤。现有防御多依赖被动拒绝，要么被自适应攻击突破，要么过度限制正常用户。本文提出基于蜜罐的主动防护系统，将风险规避转化为风险利用。框架微调一个诱饵模型，生成语义相关但无实际动作的模糊回应，作为诱饵探测用户意图。结合受保护LLM的安全回复，系统主动插入诱饵问题，通过多轮交互逐步暴露恶意行为。引入蜜罐效用评分（HUS）衡量诱饵吸引力与可行性，并以防御有效性率（DER）平衡安全与可用性。在MHJ数据集上，针对GPT-4o的多种攻击方法测试显示，本系统显著破坏越狱成功率，同时维持良好用户体验。
原文摘要 · Abstract (English)
Large language models (LLMs) are increasingly vulnerable to multi-turn jailbreak attacks, where adversaries iteratively elicit harmful behaviors that bypass single-turn safety filters. Existing defenses predominantly rely on passive rejection, which either fails against adaptive attackers or overly restricts benign users. We propose a honeypot-based proactive guardrail system that transforms risk avoidance into risk utilization. Our framework fine-tunes a bait model to generate ambiguous, non-actionable but semantically relevant responses, which serve as lures to probe user intent. Combined with the protected LLM's safe reply, the system inserts proactive bait questions that gradually expose malicious intent through multi-turn interactions. We further introduce the Honeypot Utility Score (HUS), measuring both the attractiveness and feasibility of bait responses, and use a Defense Efficacy Rate (DER) for balancing safety and usability. Initial experiment on MHJ Datasets with recent attack method across GPT-4o show that our system significantly disrupts jailbreak success while preserving benign user experience.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。