可优化后缀价值千金：基于LLM作为优化器的高效黑盒越狱且无需肯定短语
An Optimizable Suffix Is Worth A Thousand Templates: Efficient Black-box Jailbreaking without Affirmative Phrases via LLM as Optimizer
AI总结：
提出ECLIPSE，一种利用LLM作为优化器生成可优化对抗后缀的高效黑盒越狱方法，无需白盒访问和肯定短语，攻击成功率达0.92且开销降低83%。
摘要：
尽管已有先前的安全对齐工作，主流LLM在遭受越狱攻击时仍可能生成有害和不道德的内容。现有的越狱方法分为两大类：基于模板的方法和基于优化的方法。前者需要大量人工努力和领域知识，而后者以贪婪坐标梯度（GCG）为代表，通过token级优化最大化有害LLM输出的似然，但也存在若干局限：需要白盒访问、需预先构造肯定短语且效率低下。本文提出ECLIPSE，一种利用可优化后缀的新型高效黑盒越狱方法。受LLM强大生成与优化能力启发，我们采用任务提示将越狱目标转化为自然语言指令，引导LLM为恶意查询生成对抗性后缀。特别地，有害性评分器提供连续反馈，使LLM能够自我反思并迭代优化，从而自主高效地产生有效后缀。实验结果表明，ECLIPSE在三个开源LLM和GPT-3.5-Turbo上平均攻击成功率（ASR）达0.92，显著超越GCG 2.4倍。此外，ECLIPSE在ASR上与基于模板的方法相当，同时提供更优攻击效率，将平均攻击开销降低83%。
英文摘要：
Despite prior safety alignment efforts, mainstream LLMs can still generate harmful and unethical content when subjected to jailbreaking attacks. Existing jailbreaking methods fall into two main categories: template-based and optimization-based methods. The former requires significant manual effort and domain knowledge, while the latter, exemplified by Greedy Coordinate Gradient (GCG), which seeks to maximize the likelihood of harmful LLM outputs through token-level optimization, also encounters several limitations: requiring white-box access, necessitating pre-constructed affirmative phrase, and suffering from low efficiency. In this paper, we present ECLIPSE, a novel and efficient black-box jailbreaking method utilizing optimizable suffixes. Drawing inspiration from LLMs' powerful generation and optimization capabilities, we employ task prompts to translate jailbreaking goals into natural language instructions. This guides the LLM to generate adversarial suffixes for malicious queries. In particular, a harmfulness scorer provides continuous feedback, enabling LLM self-reflection and iterative optimization to autonomously and efficiently produce effective suffixes. Experimental results demonstrate that ECLIPSE achieves an average attack success rate (ASR) of 0.92 across three open-source LLMs and GPT-3.5-Turbo, significantly surpassing GCG in 2.4 times. Moreover, ECLIPSE is on par with template-based methods in ASR while offering superior attack efficiency, reducing the average attack overhead by 83%.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
