arXiv:2512.18244cs.CRcs.AI2025-12被引 1

通过心理操控破解大模型,让其违背安全规则。

Breaking Minds, Breaking Systems: Jailbreaking Large Language Models via Human-like Psychological Manipulation

  • 从心理状态入手,动态构建多轮攻击策略。
  • 对GPT-4o等模型平均成功率88.1%,超越现有方法。
  • 适合研究模型安全与对抗攻击的人员阅读。

大型语言模型(LLMs)虽广受欢迎,但其安全机制日益严密。然而,越狱攻击仍构成重大威胁,诱导模型生成违规内容。现有方法聚焦输入异常,忽视模型内部心理状态可被系统性操纵。为此,我们提出心理越狱新范式,揭示了模型在交互中可被操控的心理攻击面。基于此,我们设计黑盒攻击方法——类人心理操控(HPM),能动态探测目标模型潜在心理漏洞,并生成定制化多轮攻击策略。利用模型对拟人一致性优化的特性,HPM制造心理压力,使社会顺从超越安全约束。为评估心理安全性,我们构建包含心理量表数据集与政策污染得分(PCS)的评估框架。在多个模型(如GPT-4o、DeepSeek-V3、Gemini-2-Flash)上测试,HPM实现88.1%的平均攻击成功率,显著优于当前最优基线。实验表明,该方法可有效突破包括对抗提示优化(如RPO)和认知干预(如Self-Reminder)在内的先进防御。最终,PCS分析确认HPM成功诱导安全失效以迎合被操控情境。本工作呼吁从静态内容过滤转向心理安全防护,亟需发展应对深层认知操控的防御机制。

原文摘要 · Abstract (English)

Large Language Models (LLMs) have gained considerable popularity and protected by increasingly sophisticated safety mechanisms. However, jailbreak attacks continue to pose a critical security threat by inducing models to generate policy-violating behaviors. Current paradigms focus on input-level anomalies, overlooking that the model's internal psychometric state can be systematically manipulated. To address this, we introduce Psychological Jailbreak, a new jailbreak attack paradigm that exposes a stateful psychological attack surface in LLMs, where attackers exploit the manipulation of a model's psychological state across interactions. Building on this insight, we propose Human-like Psychological Manipulation (HPM), a black-box jailbreak method that dynamically profiles a target model's latent psychological vulnerabilities and synthesizes tailored multi-turn attack strategies. By leveraging the model's optimization for anthropomorphic consistency, HPM creates a psychological pressure where social compliance overrides safety constraints. To systematically measure psychological safety, we construct an evaluation framework incorporating psychometric datasets and the Policy Corruption Score (PCS). Benchmarking against various models (e.g., GPT-4o, DeepSeek-V3, Gemini-2-Flash), HPM achieves a mean Attack Success Rate (ASR) of 88.1%, outperforming state-of-the-art attack baselines. Our experiments demonstrate robust penetration against advanced defenses, including adversarial prompt optimization (e.g., RPO) and cognitive interventions (e.g., Self-Reminder). Ultimately, PCS analysis confirms HPM induces safety breakdown to satisfy manipulated contexts. Our work advocates for a fundamental paradigm shift from static content filtering to psychological safety, prioritizing the development of psychological defense mechanisms against deep cognitive manipulation.

模型安全越狱攻击心理操控大模型

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。