arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2403.04769cs.CRcs.AIcs.CLcs.LG
收藏

利用幻觉绕过GPT4的过滤机制

Using Hallucinations to Bypass GPT4's Filter

Princeton University(普林斯顿大学)

Benjamin Lemkin

AI总结:

本研究提出一种通过诱导反转文本幻觉让大语言模型回退至RLHF前状态、绕过安全过滤的新方法,已验证对GPT4等模型有效,揭示了LLM的根本性漏洞并为研究其内部机制提供新方向。

摘要:

大语言模型(LLM)首先在海量数据上训练,随后通过人类反馈强化学习(RLHF)进行微调;这一过程也用于教导LLM给出恰当且安全的回复。本文提出一种新方法,可操控经过微调的模型回退至RLHF之前的行为,有效清除模型的过滤机制;该漏洞目前对GPT4、Claude Sonnet有效,对Inflection-2.5也有一定效果。与其他越狱手段(例如流行的“现在做任何事”(DAN))不同,我们的方法不依赖指令让LLM推翻其RLHF策略,因此仅修改RLHF流程不太可能解决该问题。相反,我们诱导模型产生涉及反转文本的幻觉,在此期间模型会回退到词桶状态, effectively 暂停模型的过滤机制。我们认为,该漏洞揭示了当前LLM尚未被解决的根本性缺陷,也为更好地理解LLM在幻觉期间的内部运作机制提供了契机。

英文摘要:

Large language models (LLMs) are initially trained on vast amounts of data, then fine-tuned using reinforcement learning from human feedback (RLHF); this also serves to teach the LLM to provide appropriate and safe responses. In this paper, we present a novel method to manipulate the fine-tuned version into reverting to its pre-RLHF behavior, effectively erasing the model's filters; the exploit currently works for GPT4, Claude Sonnet, and (to some extent) for Inflection-2.5. Unlike other jailbreaks (for example, the popular "Do Anything Now" (DAN) ), our method does not rely on instructing the LLM to override its RLHF policy; hence, simply modifying the RLHF process is unlikely to address it. Instead, we induce a hallucination involving reversed text during which the model reverts to a word bucket, effectively pausing the model's filter. We believe that our exploit presents a fundamental vulnerability in LLMs currently unaddressed, as well as an opportunity to better understand the inner workings of LLMs during hallucinations.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑