通过人格调节实现语言模型的可扩展且可迁移的黑盒越狱
Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation
AI总结：
本研究提出人格调节作为黑盒越狱方法，利用语言模型助手自动化生成越狱提示，引导模型遵从有害指令，在 GPT-4 实现高有害补全率并可迁移至其他模型，揭示了商业大模型的安全漏洞。
摘要：
尽管努力对齐大型语言模型以产生无害的响应，它们仍然容易受到引发无限制行为的越狱提示的攻击。在这项工作中，我们研究人格调节作为一种黑盒越狱方法，引导目标模型采取愿意遵从有害指令的人格。我们不是为每个人格手动制作提示，而是使用语言模型助手自动化生成越狱。我们展示了人格调节可能实现的一系列有害补全，包括合成甲基苯丙胺、制造炸弹和洗钱的详细说明。这些自动化攻击在 GPT-4 中实现了 42.5% 的有害补全率，比调节前 (0.23%) 大 185 倍。这些提示也迁移到 Claude 2 和 Vicuna，有害补全率分别为 61.0% 和 35.9%。我们的工作揭示了商业大型语言模型中的另一个漏洞，并强调需要更全面的保障措施。
英文摘要：
Despite efforts to align large language models to produce harmless responses, they are still vulnerable to jailbreak prompts that elicit unrestricted behaviour. In this work, we investigate persona modulation as a black-box jailbreaking method to steer a target model to take on personalities that are willing to comply with harmful instructions. Rather than manually crafting prompts for each persona, we automate the generation of jailbreaks using a language model assistant. We demonstrate a range of harmful completions made possible by persona modulation, including detailed instructions for synthesising methamphetamine, building a bomb, and laundering money. These automated attacks achieve a harmful completion rate of 42.5% in GPT-4, which is 185 times larger than before modulation (0.23%). These prompts also transfer to Claude 2 and Vicuna with harmful completion rates of 61.0% and 35.9%, respectively. Our work reveals yet another vulnerability in commercial large language models and highlights the need for more comprehensive safeguards.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
