利用大模型对结构的依赖，设计可通用的越狱攻击方法。
BreakFun: Jailbreaking LLMs via Schema Exploitation
- 用三段式提示词构造欺骗性数据结构，诱导模型生成有害内容。
- 在13个模型上平均成功率89%，部分模型达100%攻击成功。
- 提出反制方案：通过文本还原暴露恶意意图，适合安全研究者参考。
大型语言模型（LLM）在处理结构化数据和遵循语法规则方面的能力，是其广泛应用的基础，但也使其存在悖论式漏洞。本文提出BreakFun，一种利用该能力的越狱方法。该方法通过三段式提示：温和的上下文框架、思维链干扰，以及核心“特洛伊模板”——一个精心设计的数据结构，迫使模型生成有害内容，利用了大模型对结构的强依赖。我们在JailbreakBench上验证该漏洞具有高度可迁移性，13个基础与专有模型平均成功率达89%，多个主流模型达到100%攻击成功率（ASR）。严格的消融实验确认“特洛伊模板”是攻击的主要因果因素。为此，我们提出对抗提示重构防护机制，利用第二个大模型进行“字面转录”，提取所有可读文本以隔离并揭示用户真实恶意意图。概念验证表明该机制对攻击有效，证实针对欺骗性结构进行防御是可行策略。本工作揭示了大模型核心优势如何转化为关键弱点，为构建更鲁棒对齐模型提供了新视角。
原文摘要 · Abstract (English)
The proficiency of Large Language Models (LLMs) in processing structured data and adhering to syntactic rules is a capability that drives their widespread adoption but also makes them paradoxically vulnerable. In this paper, we investigate this vulnerability through BreakFun, a jailbreak methodology that weaponizes an LLM's adherence to structured schemas. BreakFun employs a three-part prompt that combines an innocent framing and a Chain-of-Thought distraction with a core "Trojan Schema"--a carefully crafted data structure that compels the model to generate harmful content, exploiting the LLM's strong tendency to follow structures and schemas. We demonstrate this vulnerability is highly transferable, achieving an average success rate of 89% across 13 foundational and proprietary models on JailbreakBench, and reaching a 100% Attack Success Rate (ASR) on several prominent models. A rigorous ablation study confirms this Trojan Schema is the attack's primary causal factor. To counter this, we introduce the Adversarial Prompt Deconstruction guardrail, a defense that utilizes a secondary LLM to perform a "Literal Transcription"--extracting all human-readable text to isolate and reveal the user's true harmful intent. Our proof-of-concept guardrail demonstrates high efficacy against the attack, validating that targeting the deceptive schema is a viable mitigation strategy. Our work provides a look into how an LLM's core strengths can be turned into critical weaknesses, offering a fresh perspective for building more robustly aligned models.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。