用大模型协作生成能骗过其他大模型的对抗文本。
From Insight to Exploit: Leveraging LLM Collaboration for Adaptive Adversarial Text Generation
- 让多个大模型协作，自动产生动态对抗样本。
- 生成的对抗文本语义相似度高，却能有效欺骗目标模型。
- 适合评估大模型安全性的研究人员使用。
大模型可通过简单提示词实现零样本性能，无需训练或微调。但在敏感任务中，必须全面评估其对对抗输入的鲁棒性。本文提出静态诱骗器（StaDec）和动态诱骗器（DyDec）两种攻击框架，通过理解大模型行为，系统化生成动态、自适应的对抗样本。利用自动化的大模型驱动流水线，生成语义上与原文高度相似且自然的对抗输入，无需依赖外部启发式规则。攻击可随大模型演进而更新，并在未知模型间表现出强迁移性。该工作为大模型鲁棒性自我评估提供了系统性方法。代码与数据已开源：https://github.com/Shukti042/AdversarialExample。
原文摘要 · Abstract (English)
LLMs can provide substantial zero-shot performance on diverse tasks using a simple task prompt, eliminating the need for training or fine-tuning. However, when applying these models to sensitive tasks, it is crucial to thoroughly assess their robustness against adversarial inputs. In this work, we introduce Static Deceptor (StaDec) and Dynamic Deceptor (DyDec), two innovative attack frameworks designed to systematically generate dynamic and adaptive adversarial examples by leveraging the understanding of the LLMs. We produce subtle and natural-looking adversarial inputs that preserve semantic similarity to the original text while effectively deceiving the target LLM. By utilizing an automated, LLM-driven pipeline, we eliminate the dependence on external heuristics. Our attacks evolve with the advancements in LLMs and demonstrate strong transferability across models unknown to the attacker. Overall, this work provides a systematic approach for the self-assessment of an LLM's robustness. We release our code and data at https://github.com/Shukti042/AdversarialExample.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。