arXivDaily arXiv每日学术速递 周一至周五更新
arXiv周末暂无论文更新,休息一下吧,周末愉快~~
arXiv 2407.15399cs.CLcs.AIcs.CR
收藏

Imposter.AI:针对对齐大型语言模型的隐藏意图对抗性攻击

Imposter.AI: Adversarial Attacks with Hidden Intentions towards Aligned Large Language Models

Meetyou AI Lab(Meetyou AI实验室);Osaka University(大阪大学);East China Normal University(华东师范大学)

Xiao Liu, Liangzhi Li, Tong Xiang, Fuying Ye, Lu Wei, Wangyue Li, Noa Garcia

AI总结:

本研究提出一种利用人类对话策略的新型对抗性攻击方法,通过分解、改写和增强示例三个策略从对齐大型语言模型中提取有害信息,实验证明其优于传统方法,并引发对对话最终意图识别的思考。

摘要:

随着像ChatGPT这样的大型语言模型(LLMs)的发展,其广泛的应用和潜在的漏洞都已成为人们关注的焦点。虽然开发者已经集成了多种安全机制来减轻其滥用风险,但当模型遇到对抗性输入时,风险仍然存在。本研究揭示了一种利用人类对话策略从LLMs中提取有害信息的攻击机制。我们阐述了三个关键策略:(i)将恶意问题分解为看似无害的子问题;(ii)将明显恶意的问题改写为更隐蔽、听起来良性的问题;(iii)通过提示模型提供说明性示例来增强响应的危害性。与传统方法针对显式恶意响应不同,我们的方法更深入地探究了响应中所提供信息的本质。通过我们在GPT-3.5-turbo、GPT-4和Llama2上进行的实验,我们的方法相比传统攻击方法显示出显著的效果。总之,这项工作引入了一种优于以往方法的新型攻击方法,提出了一个重要问题:如何辨别对话中的最终意图是否恶意?

英文摘要:

With the development of large language models (LLMs) like ChatGPT, both their vast applications and potential vulnerabilities have come to the forefront. While developers have integrated multiple safety mechanisms to mitigate their misuse, a risk remains, particularly when models encounter adversarial inputs. This study unveils an attack mechanism that capitalizes on human conversation strategies to extract harmful information from LLMs. We delineate three pivotal strategies: (i) decomposing malicious questions into seemingly innocent sub-questions; (ii) rewriting overtly malicious questions into more covert, benign-sounding ones; (iii) enhancing the harmfulness of responses by prompting models for illustrative examples. Unlike conventional methods that target explicit malicious responses, our approach delves deeper into the nature of the information provided in responses. Through our experiments conducted on GPT-3.5-turbo, GPT-4, and Llama2, our method has demonstrated a marked efficacy compared to conventional attack methods. In summary, this work introduces a novel attack method that outperforms previous approaches, raising an important question: How to discern whether the ultimate intent in a dialogue is malicious?

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑