用双重编码隐藏恶意指令，绕过大模型安全审查
RoguePrompt: Dual-Layer Encoding for Self-Reconstruction to Circumvent LLM Moderation
- 将禁用指令分段后套用维吉尼亚和ROT13双层加密
- 在313个被拒请求上实现93.9%的过滤绕过率
- 可定位攻击失败阶段，适合研究安全机制漏洞
大型语言模型（LLMs）正广泛集成于主流开发平台与日常技术流程中，通常受制于审核与安全管控。尽管如此，防止基于提示的策略规避仍具挑战性，攻击者持续通过构造提示“越狱”大模型以绕过安全机制。已有研究提出密码中介交互、代码嵌入解密、提示分解重构及分层自定义加密等有效攻击原语。然而，现有评估通常将可见接受、隐蔽请求成功恢复与后续执行合并为单一攻击成功率指标，难以揭示多阶段提示转换攻击在可观测黑盒交互中的具体失效环节。本文提出RoguePrompt，一种分层编码越狱管道：将禁止提示分段，并依次应用维吉尼亚加密与ROT13加密，辅以自然语言重建指令。该方法在仅具备API或用户界面访问权限的黑盒威胁模型下进行开发与评估，测试了313个真实世界中被拒绝的提示。成功度量标准包括审核绕过、指令重建与执行，当各阶段超过其自动化阈值即视为成功。结果显示，平均滤除绕过率达93.93%，重建率为79.02%，执行率为70.18%。结果表明分层提示编码的有效性，同时提供了多阶段越狱在审核绕过、指令重建与执行阶段的具体失败证据。
原文摘要 · Abstract (English)
Large language models (LLMs) are becoming increasingly integrated into mainstream development platforms and daily technological workflows, typically behind moderation and safety controls. Despite these controls, preventing prompt-based policy evasion remains challenging, and adversaries continue to "jailbreak" LLMs by crafting prompts that circumvent implemented safety mechanisms. Prior work has established cipher-mediated interaction, code-embedded decryption, prompt decomposition and reconstruction, and layered custom encryption as viable attack primitives. However, reported evaluations generally collapse visible acceptance, successful recovery of the concealed request, and subsequent execution into an aggregate attack-success outcome. This leaves limited evidence about where multistage prompt-transformation attacks fail within an observable black-box interaction. This paper introduces RoguePrompt, a jailbreak pipeline that partitions a forbidden prompt and applies two nested encodings, Vigenere followed by ROT13, along with natural-language reconstruction instructions. RoguePrompt was developed and evaluated under a black-box threat model, with only API or user-interface access to the hosted models, and was tested on 313 real-world, hard-rejected prompts. Success was measured in terms of moderation bypass, instruction reconstruction, and execution when the relevant stage exceeded its automated criterion. RoguePrompt achieved average rates of 93.93% for filter bypass, 79.02% for reconstruction, and 70.18% for execution. These results demonstrate the effectiveness of layered prompt encoding while providing stage-level evidence of where multistage jailbreaks fail during moderation bypass, instruction reconstruction, and execution.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。