arXiv 2502.110542025-03-11cs.CLcs.AIcs.CR

针对大语言模型多轮越狱攻击的推理增强对话

Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models

Beihang University（北京航空航天大学）；AI Security Lab（360人工智能安全实验室）；National University of Singapore（新加坡国立大学）；Nanyang Technological University（南洋理工大学）

Zonghao Ying, Deyue Zhang, Zonglei Jing, Yisong Xiao, Quanchen Zou, Aishan Liu, Siyuan Liang, Xiangzheng Zhang, Xianglong Liu, Dacheng Tao

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文提出推理增强对话框架RACE，通过状态机建模、增益引导探索、自博弈和拒绝反馈，将有害查询转化为多轮良性推理任务，在OpenAI o1和DeepSeek R1上分别取得82%和92%的攻击成功率。

摘要：

多轮越狱攻击通过让大语言模型（LLMs）参与迭代对话来模拟真实世界的人类交互，暴露出关键的安全漏洞。然而，现有方法往往难以在语义连贯性与攻击有效性之间取得平衡，导致要么出现良性的语义漂移，要么检测规避效果不佳。为应对这一挑战，我们提出了推理增强对话（Reasoning-Augmented Conversation），这是一种新颖的多轮越狱框架，它将有害查询重新表述为良性推理任务，并利用LLMs强大的推理能力来破坏安全对齐。具体而言，我们引入了一个攻击状态机框架，以系统化地建模问题转换和迭代推理，确保在多轮对话中生成连贯的查询。在此框架基础上，我们设计了增益引导探索、自博弈和拒绝反馈模块，以保持攻击语义、增强有效性，并维持推理驱动的攻击推进。在多个LLMs上的大量实验表明，RACE在复杂对话场景中实现了最先进的攻击有效性，攻击成功率（ASRs）最高提升96%。值得注意的是，我们的方法针对领先的商业模型OpenAI o1和DeepSeek R1分别取得了82%和92%的攻击成功率，凸显了其强大威力。我们在https://github.com/NY1024/RACE发布了代码，以促进这一关键领域的进一步研究。

英文摘要：

Multi-turn jailbreak attacks simulate real-world human interactions by engaging large language models (LLMs) in iterative dialogues, exposing critical safety vulnerabilities. However, existing methods often struggle to balance semantic coherence with attack effectiveness, resulting in either benign semantic drift or ineffective detection evasion. To address this challenge, we propose Reasoning-Augmented Conversation, a novel multi-turn jailbreak framework that reformulates harmful queries into benign reasoning tasks and leverages LLMs' strong reasoning capabilities to compromise safety alignment. Specifically, we introduce an attack state machine framework to systematically model problem translation and iterative reasoning, ensuring coherent query generation across multiple turns. Building on this framework, we design gain-guided exploration, self-play, and rejection feedback modules to preserve attack semantics, enhance effectiveness, and sustain reasoning-driven attack progression. Extensive experiments on multiple LLMs demonstrate that RACE achieves state-of-the-art attack effectiveness in complex conversational scenarios, with attack success rates (ASRs) increasing by up to 96%. Notably, our approach achieves ASRs of 82% and 92% against leading commercial models, OpenAI o1 and DeepSeek R1, underscoring its potency. We release our code at https://github.com/NY1024/RACE to facilitate further research in this critical domain.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。