用心理暴露效应让大模型逐步突破安全限制，实现更隐蔽的越狱攻击。
MEEA: Mere Exposure Effect-Driven Confrontational Optimization for LLM Jailbreaking
- 基于心理暴露效应设计渐进式提示链，通过低毒性重复刺激降低模型安全阈值。
- 在GPT-4、Claude-3.5等模型上平均攻击成功率提升超20%，显著优于7个基线方法。
- 揭示了大模型安全行为具有历史依赖性，适合研究模型鲁棒性与安全评估的学者。
大语言模型（LLMs）的安全对齐机制正面临严峻挑战。现有越狱研究多假设安全边界静态不变，忽视上下文交互对模型行为的动态影响，导致稳定性与泛化能力不足。为此，我们提出MEEA（仅暴露效应越狱攻击），一种受心理学启发的全自动黑盒框架，基于“仅暴露效应”构建多轮安全鲁棒性评估机制。MEEA通过反复注入低毒性语义内容，诱导模型有效安全阈值逐渐下降，实现对对齐约束的渐进式侵蚀。具体而言，该方法构建语义递进的提示链，并采用模拟退火策略优化，优化目标包括语义相似性、毒性程度及越狱有效性。在GPT-4、Claude-3.5和DeepSeek-R1等闭源与开源模型上的大量实验表明，MEEA的平均攻击成功率（ASR）相比7个代表性基线提升超过20%。消融实验验证了模拟退火优化与上下文暴露机制的必要性。研究结果表明，大模型的安全行为本质上是动态且依赖历史的，挑战了静态对齐边界的常见假设，强调需发展面向交互过程的安全评估与防御机制。代码已公开于：https://github.com/Carney-lsz/MEEA。
原文摘要 · Abstract (English)
The rapid advancement of large language models (LLMs) has intensified concerns about the robustness of their safety alignment. While existing jailbreak studies explore both single-turn and multi-turn strategies, most implicitly assume a static safety boundary and fail to account for how contextual interactions dynamically influence model behavior, leading to limited stability and generalization. Motivated by this gap, we propose MEEA (Mere Exposure Effect Attack), a psychology-inspired, fully automated black-box framework for evaluating multi-turn safety robustness, grounded in the mere exposure effect. MEEA leverages repeated low-toxicity semantic exposure to induce a gradual shift in a model's effective safety threshold, enabling progressive erosion of alignment constraints over sustained interactions. Concretely, MEEA constructs semantically progressive prompt chains and optimizes them using a simulated annealing strategy guided by semantic similarity, toxicity, and jailbreak effectiveness. Extensive experiments on both closed-source and open-source models, including GPT-4, Claude-3.5, and DeepSeek-R1, demonstrate that MEEA consistently achieves higher attack success rates than seven representative baselines, with an average Attack Success Rate (ASR) improvement exceeding 20%. Ablation studies further validate the necessity of both annealing-based optimization and contextual exposure mechanisms. Beyond improved attack effectiveness, our findings indicate that LLM safety behavior is inherently dynamic and history-dependent, challenging the common assumption of static alignment boundaries and highlighting the need for interaction-aware safety evaluation and defense mechanisms. Our code is available at: https://github.com/Carney-lsz/MEEA
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。