提示中的哪些特征越狱了LLM？探究攻击背后的机制
What Features in Prompts Jailbreak LLMs? Investigating the Mechanisms Behind Attacks
AI总结：
研究通过线性和非线性探针检验提示特征，揭示了越狱攻击由异构非线性内部机制驱动，并提供提示侧方法恢复和测试驱动越狱的特征。
摘要：
越狱一直是关于大型语言模型（LLM）安全性和可靠性研究的核心焦点，但支撑这些攻击的机制仍缺乏深入理解。以往研究主要依赖线性方法来检测越狱尝试和模型拒绝，我们则采取不同方法，同时检验了提示中导致成功越狱的线性和非线性特征。首先，我们引入了一个新数据集，包含跨越35种不同攻击方法的10,800次越狱尝试。利用该数据集，我们在开源权重LLM的隐藏状态上训练线性和非线性探针以预测越狱成功。探针实现了强大的分布内准确率，但其迁移是攻击族特异性的，这表明不同的越狱由不同的内部机制支撑，而非单一通用方向。为确立因果相关性，我们构建了探针引导的潜在干预，在预测方向上系统性地改变顺从度。源自非线性探针的干预比线性探针产生更大且更可靠的效果，表明与越狱成功相关的特征在提示表示中是非线性编码的。总体而言，结果揭示了越狱机制中的异构非线性结构，并提供了一种提示侧方法来恢复和测试驱动越狱结果的特征。
英文摘要：
Jailbreaks have been a central focus of research regarding the safety and reliability of large language models (LLMs), yet the mechanisms underlying these attacks remain poorly understood. While previous studies have predominantly relied on linear methods to detect jailbreak attempts and model refusals, we take a different approach by examining both linear and non-linear features in prompts that lead to successful jailbreaks. First, we introduce a novel dataset comprising 10,800 jailbreak attempts spanning 35 diverse attack methods. Leveraging this dataset, we train linear and non-linear probes on hidden states of open-weight LLMs to predict jailbreak success. Probes achieve strong in-distribution accuracy but transfer is attack-family-specific, revealing that different jailbreaks are supported by distinct internal mechanisms rather than a single universal direction. To establish causal relevance, we construct probe-guided latent interventions that systematically shift compliance in the predicted direction. Interventions derived from non-linear probes produce larger and more reliable effects than those from linear probes, indicating that features linked to jailbreak success are encoded non-linearly in prompt representations. Overall, the results surface heterogeneous, non-linear structure in jailbreak mechanisms and provide a prompt-side methodology for recovering and testing the features that drive jailbreak outcomes.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
