自动化多轮攻击框架，让大模型漏洞暴露率高达95%。
AutoAdv: Automated Adversarial Prompting for Multi-Turn Jailbreaking of Large Language Models
- 用自适应机制自动演化攻击提示，突破单轮限制。
- 六轮内对Llama-3.1-8B攻击成功率95%，比单轮高24%。
- 揭示当前安全机制在多轮对话中严重失效，需新防御策略。
大型语言模型仍易受越狱攻击，恶意提示可诱导有害输出。然而现有评估多集中于单轮交互，而真实攻击通常为动态的多轮对话。本文提出AutoAdv，一种无需训练的自动化多轮越狱框架，在六轮内对Llama-3.1-8B实现最高95%的攻击成功率，较单轮基线提升24%。该框架融合三种自适应机制：模式管理器学习成功攻击以优化后续提示，温度管理器根据失败模式动态调整采样参数，以及两阶段重写策略先伪装有害请求再逐步优化。在商业与开源模型（Llama-3.1-8B、GPT-4o mini、Qwen3-235B、Mistral-7B）上的广泛测试表明，当前安全机制存在持续漏洞，多轮攻击始终优于单轮方法。结果说明，专为单轮设计的对齐策略无法保障多轮对话中的鲁棒性，亟需面向多轮交互的新型防御方案。
原文摘要 · Abstract (English)
Large Language Models (LLMs) remain vulnerable to jailbreaking attacks where adversarial prompts elicit harmful outputs. Yet most evaluations focus on single-turn interactions while real-world attacks unfold through adaptive multi-turn conversations. We present AutoAdv, a training-free framework for automated multi-turn jailbreaking that achieves an attack success rate of up to 95% on Llama-3.1-8B within six turns, a 24% improvement over single-turn baselines. AutoAdv uniquely combines three adaptive mechanisms: a pattern manager that learns from successful attacks to enhance future prompts, a temperature manager that dynamically adjusts sampling parameters based on failure modes, and a two-phase rewriting strategy that disguises harmful requests and then iteratively refines them. Extensive evaluation across commercial and open-source models (Llama-3.1-8B, GPT-4o mini, Qwen3-235B, Mistral-7B) reveals persistent vulnerabilities in current safety mechanisms, with multi-turn attacks consistently outperforming single-turn approaches. These findings demonstrate that alignment strategies optimized for single-turn interactions fail to maintain robustness across extended conversations, highlighting an urgent need for multi-turn-aware defenses.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。