PUZZLED：通过基于单词的谜题越狱大语言模型
PUZZLED: Jailbreaking LLMs through Word-Based Puzzles
AI总结：
PUZZLED通过将有害指令中的关键词掩蔽为单词搜索、变位词和填字游戏等谜题，利用LLM推理能力实现越狱，在五个先进模型上平均攻击成功率达88.8%。
摘要：
随着大语言模型（LLMs）在各领域的部署日益广泛，确保其安全性已成为一个关键问题。为此，针对越狱攻击的研究正在积极增长。现有方法通常依赖迭代式提示工程或对有害指令进行语义变换来逃避检测。在本工作中，我们提出了PUZZLED，一种新颖的越狱方法，它利用了大语言模型的推理能力。该方法将有害指令中的关键词进行掩蔽，并将其作为单词谜题呈现给模型解决。我们设计了三种谜题类型——单词搜索、变位词和填字游戏——这些谜题对人类而言熟悉，但对大语言模型来说认知要求较高。模型必须解决谜题以揭示被掩蔽的单词，然后继续生成对重构后的有害指令的响应。我们在五个最先进的大语言模型上评估了PUZZLED，观察到高达88.8%的平均攻击成功率（ASR），其中在GPT-4.1上为96.5%，在Claude 3.7 Sonnet上为92.3%。PUZZLED是一种简单而强大的攻击方法，通过利用大语言模型的推理能力，将熟悉的谜题转化为有效的越狱策略。
英文摘要：
As large language models (LLMs) are increasingly deployed across diverse domains, ensuring their safety has become a critical concern. In response, studies on jailbreak attacks have been actively growing. Existing approaches typically rely on iterative prompt engineering or semantic transformations of harmful instructions to evade detection. In this work, we introduce PUZZLED, a novel jailbreak method that leverages the LLM's reasoning capabilities. It masks keywords in a harmful instruction and presents them as word puzzles for the LLM to solve. We design three puzzle types-word search, anagram, and crossword-that are familiar to humans but cognitively demanding for LLMs. The model must solve the puzzle to uncover the masked words and then proceed to generate responses to the reconstructed harmful instruction. We evaluate PUZZLED on five state-of-the-art LLMs and observe a high average attack success rate (ASR) of 88.8%, specifically 96.5% on GPT-4.1 and 92.3% on Claude 3.7 Sonnet. PUZZLED is a simple yet powerful attack that transforms familiar puzzles into an effective jailbreak strategy by harnessing LLMs' reasoning capabilities.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
