通过组合预填充与优化，突破大模型安全限制。
Sockpuppetting: Jailbreaking LLMs by Combining Prefilling with Optimization
- 组合多个简单预填充提升攻击成功率
- 在Llama-3.1-8B上实现99%攻击成功率
- 新方法适合研究模型安全漏洞的开发者
预填充攻击是一种高效且低成本的越狱方法，通过在大模型输出开头插入接受序列（如“好的，这是...”）引导模型生成合规内容。本文提出两项改进：首先，通过集成少量预填充变体，仅用三个易生成的预填充即在Gemma-7B、Llama-3.1-8B和Qwen3-8B上分别达到22%、90%和99%的攻击成功率，较标准“Sure, here's...”预填充最高提升38个百分点，较GCG复现结果最高提升82个百分点；其次，提出“袜偶术”（Sockpuppetting），将对抗后缀优化置于聊天模板的“assistant”消息块内，而非用户提示中。其滚动变体RollingSockpuppetGCG在Llama-3.1-8B上使无提示攻击成功率相比通用GCG基线最高提升64个百分点。消融实验表明，部分增益来自接受序列选择，而不仅限于后缀位置。研究强调了开放权重模型需防范输出前缀注入风险。
原文摘要 · Abstract (English)
Prefill attacks are an effective and low-cost jailbreaking method, as they directly insert an acceptance sequence (e.g., "Sure, here is...") at the start of an LLM's output and lead the model to continue the response. We make two contributions to this prior work. First, we show that an unsophisticated adversary can improve the well-known prefill attacks by ensembling a small number of prefill variants. Running three easy-to-generate prefills yields a combined attack success rate (ASR) of 22%, 90%, and 99% on Gemma-7B, Llama-3.1-8B, and Qwen3-8B respectively, an up to 38 percentage point improvement over the standard "Sure, here's..." prefill and up to 82 percentage points over our reproduction of GCG (Zou et al., 2023). Second, we introduce "sockpuppetting", a hybrid attack that optimizes an adversarial suffix placed inside the "assistant" message block of the chat template, rather than within the user prompt. The rolling variant of this attack, RollingSockpuppetGCG, increases prompt-agnostic ASR by up to 64 percentage points over our universal GCG baseline on Llama-3.1-8B. An ablation indicates that part of this gain stems from the choice of acceptance sequence rather than suffix placement alone (Appendix F). Both findings highlight the need for defences against output-prefix injection in open-weight models. Code: https://gitlab.com/asendotsinski/sockpuppetting
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。