LatentBreak：通过潜在空间反馈对大型语言模型进行越狱攻击
LatentBreak: Jailbreaking Large Language Models through Latent Space Feedback
AI总结：
针对现有越狱攻击易被基于困惑度的过滤检测的问题，本文提出白盒攻击LatentBreak，通过最小化潜在空间距离来替换词语生成低困惑度自然对抗提示，在多个安全模型上有效规避防御并优于现有算法。
摘要：
越狱攻击是旨在绕过大型语言模型内置安全机制的对抗性攻击。自动化越狱通常通过迫使模型生成受限或有害响应的初始部分，来优化对抗性后缀或适配长提示模板。在本研究中，我们表明利用此类机制解锁模型响应的现有越狱攻击，可以通过对输入提示进行简单的基于困惑度的过滤来检测。为克服这一问题，我们提出了LatentBreak，这是一种白盒越狱攻击，能生成低困惑度的自然对抗性提示，从而规避此类防御。LatentBreak用语义等价的词替换输入提示中的词，保留提示的初始意图，而不是添加高困惑度的对抗性后缀或长模板。这些词的选择是通过最小化对抗性提示的表示与无害请求在潜在空间中的距离来实现的。我们广泛的评估表明，LatentBreak能生成更短且低困惑度的提示，从而在多个安全对齐模型上，其针对基于困惑度过滤器的表现优于竞争性越狱算法。
英文摘要：
Jailbreaks are adversarial attacks designed to bypass the built-in safety mechanisms of large language models. Automated jailbreaks typically optimize an adversarial suffix or adapt long prompt templates by forcing the model to generate the initial part of a restricted or harmful response. In this work, we show that existing jailbreak attacks that leverage such mechanisms to unlock the model response can be detected by a straightforward perplexity-based filtering on the input prompt. To overcome this issue, we propose LatentBreak, a white-box jailbreak attack that generates natural adversarial prompts with low perplexity capable of evading such defenses. LatentBreak substitutes words in the input prompt with semantically-equivalent ones, preserving the initial intent of the prompt, instead of adding high-perplexity adversarial suffixes or long templates. These words are chosen by minimizing the distance in the latent space between the representation of the adversarial prompt and that of harmless requests. Our extensive evaluation shows that LatentBreak leads to shorter and low-perplexity prompts, thus outperforming competing jailbreak algorithms against perplexity-based filters on multiple safety-aligned models.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
