通过共享前缀缓存，加速后缀越狱攻击的生成效率。
Accelerating Suffix Jailbreak attacks with Prefix-Shared KV-cache
- 共享前缀的键值缓存，避免重复计算相同前缀。
- 推理时间减少40%，峰值内存降低50%。
- 适合需要高效红队测试大模型安全性的研究者。
后缀越狱攻击是系统化红队测试大语言模型（LLMs）的有效方法，但因需评估大量候选后缀而带来高昂计算成本。本文提出前缀共享键值缓存（PSKV），一种专为越狱后缀生成设计的即插即用推理优化技术。核心思想是：在进行后缀越狱时，尽管需评估多个候选提示，但它们共享相同的有害指令前缀。因此，PSKV仅对前缀计算一次并共享其键值缓存，使不同后缀可并行推理，且内存开销极低。该设计支持更激进的批处理策略，突破原有内存限制。在五个主流大模型上针对六种常用后缀攻击的实验表明，PSKV将推理时间减少40%，峰值内存使用降低50%，同时保持原始攻击成功率（ASR）。代码已提交，将公开发布。
原文摘要 · Abstract (English)
Suffix jailbreak attacks serve as a systematic method for red-teaming Large Language Models (LLMs) but suffer from prohibitive computational costs, as a large number of candidate suffixes need to be evaluated before identifying a jailbreak suffix. This paper presents Prefix-Shared KV Cache (PSKV), a plug-and-play inference optimization technique tailored for jailbreak suffix generation. Our method is motivated by a key observation that when performing suffix jailbreaking, while a large number of candidate prompts need to be evaluated, they share the same targeted harmful instruction as the prefix. Therefore, instead of performing redundant inference on the duplicated prefix, PSKV maintains a single KV cache for this prefix and shares it with every candidate prompt, enabling the parallel inference of diverse suffixes with minimal memory overhead. This design enables more aggressive batching strategies that would otherwise be limited by memory constraints. Extensive experiments on six widely used suffix attacks across five widely deployed LLMs demonstrate that PSKV reduces inference time by 40\% and peak memory usage by 50\%, while maintaining the original Attack Success Rate (ASR). The code has been submitted and will be released publicly.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。