提出局部因果解释方法，揭示特定越狱攻击成功的原因。
Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Models
- 通过识别最小可解释的中间表示变化，定位越狱成功的因果机制。
- 平均仅需6次可解释修改即可触发模型拒绝，优于此前方法在20次修改下的失败表现。
- 适用于理解不同越狱策略对不同类型有害请求的攻防差异，适合安全研究者使用。
经过安全训练的大语言模型（LLMs）常被越狱提示诱导回答有害请求。由于缺乏对模型为何易受越狱攻击的可靠理解，未来更自主运行于高风险场景的前沿模型也可能面临类似威胁。先前工作通过分析模型中间表示，识别出编码有害性与拒绝行为的概念方向，并将所有越狱攻击归因为试图减弱或增强这些概念（如降低有害性）。然而，不同越狱策略可能通过强化或抑制不同中间概念成功，同一策略对不同有害请求类别（如暴力与网络攻击）效果也各异；因此，我们寻求局部解释——即为何此次越狱成功？为此，我们提出LOCA方法，实现对越狱成功的局部、因果解释，通过识别最小一组可解释的中间表示变化，来因果诱导原本成功的越狱请求被模型拒绝。我们在Gemma、Llama和Qwen聊天模型上，基于大规模越狱基准数据集中的原始-越狱配对进行评估，对比适配该场景的先前方法。结果表明，LOCA平均仅需六次可解释修改即可成功诱导拒绝，而先前方法在20次修改后仍无法达成拒绝。该工作是迈向大语言模型越狱成功机制化、局部解释的重要一步。代码已公开于https://github.com/skumar-ml/loca-jailbreaks。
原文摘要 · Abstract (English)
Safety trained large language models (LLMs) can often be induced to answer harmful requests through jailbreak prompts. Because we lack a robust understanding of why LLMs are susceptible to jailbreaks, future frontier models operating more autonomously in higher-stakes settings may similarly be vulnerable to such attacks. Prior work has studied jailbreak success by examining the model's intermediate representations, identifying directions in this space that causally encode concepts like harmfulness and refusal. Then, they globally explain all jailbreak attacks as attempting to reduce or strengthen these concepts (e.g., reduce harmfulness). However, different jailbreak strategies may succeed by strengthening or suppressing different intermediate concepts, and the same jailbreak strategy may not work for different harmful request categories (e.g., violence vs. cyberattack); thus, we seek to give a local explanation -- i.e., why did this specific jailbreak succeed? To address this gap, we introduce LOCA, a method that gives Local, CAusal explanations of jailbreak success by identifying a minimal set of interpretable, intermediate representation changes that causally induce model refusal on an otherwise successful jailbreak request. We evaluate LOCA on harmful original-jailbreak pairs from a large jailbreak benchmark across Gemma, Llama, and Qwen chat models, comparing against prior methods adapted to this setting. LOCA can successfully induce refusal by making, on average, six interpretable changes; prior work routinely fails to achieve refusal even after 20 changes. LOCA is a step toward mechanistic, local explanations of jailbreak success in LLMs. Code publicly available at https://github.com/skumar-ml/loca-jailbreaks
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。