用预存提示库匹配攻击，低成本高效突破大模型安全防护
RECAP: A Resource-Efficient Method for Adversarial Prompting in Large Language Models
- 不重训练，从预存数据库中检索语义相似的攻击提示
- 在Llama 3 8B上对7类危害实现90%以上攻击成功率
- 适合资源有限团队做模型安全测试与红队评估
大语言模型部署后易受对抗性提示攻击，导致生成有害内容。尽管对齐机制和防护策略能缓解常见滥用，但仍面临GCG、PEZ、GBDA等自动化越狱方法威胁，这些方法通过训练和梯度搜索生成对抗后缀，但计算开销大，限制了实际应用。本文提出一种资源高效对抗提示方法，无需重训练，通过匹配预训练对抗提示库实现攻击。构建包含1000个提示的数据集并分类为7类危害，评估三种方法在Llama 3 8B上的表现，发现提示类型与算法有效性存在关联。通过检索语义相似的成功攻击提示，新方法在显著降低计算成本的同时，达到接近原方法的攻击成功率。该工作为可扩展的红队测试与对齐模型安全评估提供了实用框架，尤其适用于无法访问模型内部的场景。
原文摘要 · Abstract (English)
The deployment of large language models (LLMs) has raised security concerns due to their susceptibility to producing harmful or policy-violating outputs when exposed to adversarial prompts. While alignment and guardrails mitigate common misuse, they remain vulnerable to automated jailbreaking methods such as GCG, PEZ, and GBDA, which generate adversarial suffixes via training and gradient-based search. Although effective, these methods particularly GCG are computationally expensive, limiting their practicality for organisations with constrained resources. This paper introduces a resource-efficient adversarial prompting approach that eliminates the need for retraining by matching new prompts to a database of pre-trained adversarial prompts. A dataset of 1,000 prompts was classified into seven harm-related categories, and GCG, PEZ, and GBDA were evaluated on a Llama 3 8B model to identify the most effective attack method per category. Results reveal a correlation between prompt type and algorithm effectiveness. By retrieving semantically similar successful adversarial prompts, the proposed method achieves competitive attack success rates with significantly reduced computational cost. This work provides a practical framework for scalable red-teaming and security evaluation of aligned LLMs, including in settings where model internals are inaccessible.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。