通过思维链增强对抗攻击
Enhancing Adversarial Attacks through Chain of Thought
AI总结：
本研究针对大语言模型的安全漏洞，将思维链提示与贪心坐标梯度技术结合提出CoT-GCG方法，提升了对抗攻击的可迁移性与效果，并通过Llama Guard实现更客观的风险评估。
摘要：
大语言模型（LLMs）已在各领域展现出出色性能，但仍存在安全隐患。已有研究表明，基于梯度的对抗攻击对经过对齐的LLMs尤为有效，而思维链（CoT）提示可通过逐步推理诱导出目标答案。本文提出将CoT提示与贪心坐标梯度（GCG）技术相结合，以提升针对对齐LLMs的对抗攻击鲁棒性。使用CoT触发词替代肯定性目标能够激发后端LLMs的推理能力，从而提升对抗攻击的可迁移性与通用性。我们开展了消融研究，将所提CoT-GCG方法与Amazon Web Services auto-cot进行对比。结果显示，该方法的表现优于基线GCG攻击和CoT提示。此外，我们使用Llama Guard评估潜在有害交互，相较于将输出与拒绝短语匹配的方式，能对完整对话给出更客观的风险评估。本文代码可在https://github.com/sujingbo0217/CS222W24-LLM-Attack获取。
英文摘要：
Large language models (LLMs) have demonstrated impressive performance across various domains but remain susceptible to safety concerns. Prior research indicates that gradient-based adversarial attacks are particularly effective against aligned LLMs and the chain of thought (CoT) prompting can elicit desired answers through step-by-step reasoning. This paper proposes enhancing the robustness of adversarial attacks on aligned LLMs by integrating CoT prompts with the greedy coordinate gradient (GCG) technique. Using CoT triggers instead of affirmative targets stimulates the reasoning abilities of backend LLMs, thereby improving the transferability and universality of adversarial attacks. We conducted an ablation study comparing our CoT-GCG approach with Amazon Web Services auto-cot. Results revealed our approach outperformed both the baseline GCG attack and CoT prompting. Additionally, we used Llama Guard to evaluate potentially harmful interactions, providing a more objective risk assessment of entire conversations compared to matching outputs to rejection phrases. The code of this paper is available at https://github.com/sujingbo0217/CS222W24-LLM-Attack.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
