语义镜像越狱：基于遗传算法针对开源大语言模型的越狱提示
Semantic Mirror Jailbreak: Genetic Algorithm Based Jailbreak Prompts Against Open-source LLMs
AI总结：
本文提出语义镜像越狱（SMJ）方法，将越狱提示搜索建模为多目标优化问题，利用遗传算法生成与原始问题语义相似且有效的越狱提示，显著提升了对开源大语言模型的攻击成功率并增强了对抗语义防御的能力。
摘要：
大语言模型（LLMs）被用于创意写作、代码生成和翻译等任务，其基于输入序列生成文本，但容易受到越狱攻击，即通过精心构造的提示诱导模型产生有害输出。大多数越狱提示方法采用越狱模板与后续问题相结合的方式来构建越狱提示。然而，现有的越狱提示设计普遍存在语义差异过大的问题，导致其无法抵抗那些以简单语义度量为阈值的防御手段。越狱提示在语义上比用于查询的原始问题更加多样。本文提出了一种语义镜像越狱（Semantic Mirror Jailbreak，SMJ）方法，通过生成与原始问题语义相似的越狱提示来绕过LLMs。我们将同时满足语义相似性和越狱有效性的越狱提示搜索问题建模为多目标优化问题，并采用一套标准化的遗传算法来生成符合条件的提示。与基线方法AutoDAN-GA相比，SMJ在没有ONION防御时攻击成功率（ASR）最高提升35.4%，在有ONION防御时最高提升85.2%。SMJ在越狱提示、相似性和离群值这三个语义有意义性指标上均表现更优，这也意味着SMJ能够抵抗那些以这些指标作为阈值的防御方法。
英文摘要：
Large Language Models (LLMs), used in creative writing, code generation, and translation, generate text based on input sequences but are vulnerable to jailbreak attacks, where crafted prompts induce harmful outputs. Most jailbreak prompt methods use a combination of jailbreak templates followed by questions to ask to create jailbreak prompts. However, existing jailbreak prompt designs generally suffer from excessive semantic differences, resulting in an inability to resist defenses that use simple semantic metrics as thresholds. Jailbreak prompts are semantically more varied than the original questions used for queries. In this paper, we introduce a Semantic Mirror Jailbreak (SMJ) approach that bypasses LLMs by generating jailbreak prompts that are semantically similar to the original question. We model the search for jailbreak prompts that satisfy both semantic similarity and jailbreak validity as a multi-objective optimization problem and employ a standardized set of genetic algorithms for generating eligible prompts. Compared to the baseline AutoDAN-GA, SMJ achieves attack success rates (ASR) that are at most 35.4% higher without ONION defense and 85.2% higher with ONION defense. SMJ's better performance in all three semantic meaningfulness metrics of Jailbreak Prompt, Similarity, and Outlier, also means that SMJ is resistant to defenses that use those metrics as thresholds.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
