PLAGUE：面向多轮利用的终身自适应生成的即插即用框架
PLAGUE: Plug-and-play framework for Lifelong Adaptive Generation of Multi-turn Exploits
AI总结：
提出PLAGUE框架，通过终身学习启发的三阶段设计（Primer、Planner、Finisher）实现高效多轮越狱攻击，在o3和Opus 4.1等强安全模型上ASR提升超30%。
摘要：
大型语言模型（LLMs）正以惊人的速度改进。随着智能体工作流的出现，多轮对话已成为与LLMs交互以完成长而复杂任务的事实标准。尽管LLM能力持续提升，但它们仍然越来越容易受到越狱攻击，尤其是在多轮场景中，有害意图可以巧妙地注入到对话中，产生恶意结果。虽然单轮攻击已被广泛探索，但适应性、效率和有效性仍然是多轮攻击面临的关键挑战。为了解决这些不足，我们提出了PLAGUE，一种新颖的即插即用框架，用于设计受终身学习智能体启发的多轮攻击。PLAGUE将多轮攻击的生命周期分解为三个精心设计的阶段（Primer、Planner和Finisher），从而实现对多轮攻击家族的系统性和信息丰富的探索。评估表明，使用PLAGUE设计的红队智能体实现了最先进的越狱结果，在更少或相当的查询预算下，领先模型的攻击成功率（ASR）提高了30%以上。特别是，PLAGUE在OpenAI的o3上实现了81.4%的ASR（基于StrongReject），在Claude的Opus 4.1上实现了67.3%的ASR，这两个模型在安全文献中被认为对越狱具有高度抵抗力。我们的工作提供了工具和见解，以理解计划初始化、上下文优化和终身学习在构建多轮攻击以进行全面模型脆弱性评估中的重要性。
英文摘要：
Large Language Models (LLMs) are improving at an exceptional rate. With the advent of agentic workflows, multi-turn dialogue has become the de facto mode of interaction with LLMs for completing long and complex tasks. While LLM capabilities continue to improve, they remain increasingly susceptible to jailbreaking, especially in multi-turn scenarios where harmful intent can be subtly injected across the conversation to produce nefarious outcomes. While single-turn attacks have been extensively explored, adaptability, efficiency and effectiveness continue to remain key challenges for their multi-turn counterparts. To address these gaps, we present PLAGUE, a novel plug-and-play framework for designing multi-turn attacks inspired by lifelong-learning agents. PLAGUE dissects the lifetime of a multi-turn attack into three carefully designed phases (Primer, Planner and Finisher) that enable a systematic and information-rich exploration of the multi-turn attack family. Evaluations show that red-teaming agents designed using PLAGUE achieve state-of-the-art jailbreaking results, improving attack success rates (ASR) by more than 30% across leading models in a lesser or comparable query budget. Particularly, PLAGUE enables an ASR (based on StrongReject) of 81.4% on OpenAI's o3 and 67.3% on Claude's Opus 4.1, two models that are considered highly resistant to jailbreaks in safety literature. Our work offers tools and insights to understand the importance of plan initialization, context optimization and lifelong learning in crafting multi-turn attacks for a comprehensive model vulnerability evaluation.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
