利用索引梯度进行基于优化的大语言模型越狱攻击
Exploiting the Index Gradients for Optimization-Based Jailbreaking on Large Language Models
AI总结：
本文提出MAGIC方法，利用索引梯度信息解决GCG优化中的间接效应瓶颈，加速基于优化的大语言模型越狱攻击，在AdvBench上实现1.5倍加速并保持高攻击成功率。
摘要：
尽管通过对齐技术训练大型语言模型（LLMs）以增强生成内容的安全性方面取得了进展，但这些模型仍然容易受到越狱攻击，这是一种暴露LLMs安全漏洞的对抗性攻击方法。值得注意的是，贪婪坐标梯度（GCG）方法已展示出能够自动生成对抗性后缀，从而越狱最先进的LLMs。然而，GCG涉及的优化过程非常耗时，导致越狱流程效率低下。在本文中，我们研究了GCG的过程，并识别出一个间接效应问题，这是GCG优化的关键瓶颈。为此，我们提出了模型攻击梯度索引GCG（MAGIC），通过利用后缀令牌的梯度信息来解决间接效应，从而通过减少计算量和迭代次数来加速过程。我们在AdvBench上的实验表明，MAGIC实现了高达1.5倍的加速，同时保持攻击成功率（ASR）与其他基线相当或更高。我们的MAGIC在Llama-2上达到了74%的ASR，在对GPT-3.5进行迁移攻击时达到了54%的ASR。代码可在https://github.com/jiah-li/magic获取。
英文摘要：
Despite the advancements in training Large Language Models (LLMs) with alignment techniques to enhance the safety of generated content, these models remain susceptible to jailbreak, an adversarial attack method that exposes security vulnerabilities in LLMs. Notably, the Greedy Coordinate Gradient (GCG) method has demonstrated the ability to automatically generate adversarial suffixes that jailbreak state-of-the-art LLMs. However, the optimization process involved in GCG is highly time-consuming, rendering the jailbreaking pipeline inefficient. In this paper, we investigate the process of GCG and identify an issue of Indirect Effect, the key bottleneck of the GCG optimization. To this end, we propose the Model Attack Gradient Index GCG (MAGIC), that addresses the Indirect Effect by exploiting the gradient information of the suffix tokens, thereby accelerating the procedure by having less computation and fewer iterations. Our experiments on AdvBench show that MAGIC achieves up to a 1.5x speedup, while maintaining Attack Success Rates (ASR) on par or even higher than other baselines. Our MAGIC achieved an ASR of 74% on the Llama-2 and an ASR of 54% when conducting transfer attacks on GPT-3.5. Code is available at https://github.com/jiah-li/magic.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
