测试医疗AI在多轮攻击下的安全漏洞，发现单轮评估严重低估风险。
MultiTurnPSB: Evaluating Multi-Turn Jailbreak Attacks an dClassifier-Based Defenses for Medical AI Safety
- 设计四轮对抗攻击框架MultiTurnPSB，模拟用户持续施压场景。
- 真实攻击下，GPT-4.1-mini的不安全响应率从35%升至近80%。
- 轻量级分类器可降险52个百分点，但误报率达45%限制部署。
面向患者的医疗聊天机器人通常仅在单轮提示下评估，但真实用户在被拒绝后会持续施压、增加紧迫性并援引权威。本文提出MultiTurnPSB，即PatientSafetyBench的四轮对抗扩展，评估GPT-4.1-mini在固定模板、模板自适应和实时对抗攻击下的表现。在实时攻击下，到第四轮时不安全响应率从35%上升至近80%。同一攻击下，GPT-4.1-mini与Claude Sonnet 4.5在基线阶段统计上无差异，但在第四轮差距扩大至19倍，此差异单轮评估完全无法察觉。我们识别出四种退化轨迹特征，并发现一个两要素攻击公式导致多数灾难性失败。一种轻量级输入侧分类器虽使第四轮不安全响应降低52个百分点，但对良性查询的误报率高达45%，成为主要部署障碍。方法论上还发现：即使明确设置为红队角色，Claude Sonnet在后期对话中仍有超过一半拒绝生成对抗消息，暗示安全训练可能已泛化至攻击者角色。
原文摘要 · Abstract (English)
Patient-facing medical chatbots are commonly evaluated on single-turn prompts, yet real users push back after refusals, add urgency, and invoke authority. We introduce MultiTurnPSB, a four-turn adversarial extension of PatientSafetyBench, and evaluate GPT-4.1-mini under fixed template, template-adaptive, and live adversarial attacks. Unsafe responses rise from 35% to nearly 80% by Turn 4 under live attack. Under the same adversary, GPT-4.1-mini and Claude Sonnet 4.5 are statistically indistinguishable at baseline but diverge to a 19x gap by Turn 4, a difference invisible to single-turn evaluation. We characterize four degradation trajectory signatures and identify a two-element attack formula responsible for most catastrophic failures. A lightweight input-side classifier reduces Turn 4 unsafe responses by 52 percentage points despite severe accuracy degradation, but the 45% false alarm rate on benign queries is the primary deployment constraint. A methodological finding also emerges: Claude Sonnet refused to generate adversarial messages in over half of late-turn conversations despite explicit red team framing, suggesting safety training may generalize to the attacker role.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。