相邻词，分歧意图：通过任务并发越狱大型语言模型
Adjacent Words, Divergent Intents: Jailbreaking Large Language Models via Task Concurrency
AI总结：
本研究提出词级任务并发方法及迭代攻击框架JAIL-CON，通过将有害任务与良性任务并发组合，显著降低护栏过滤概率，实现对大型语言模型的高隐蔽性越狱。
摘要：
尽管大型语言模型（LLMs）在广泛领域表现出优越性能，但它们仍然容易受到滥用，从而生成有害内容，这一风险因各种越狱攻击而进一步加剧。现有的越狱攻击主要遵循顺序逻辑，即LLMs逐一理解并回答每个给定的任务。然而，并发作为顺序场景的自然扩展，在很大程度上被忽视了。在这项工作中，我们首先提出了一种词级方法，使LLMs能够实现任务并发，其中相邻的词编码了分歧的意图。尽管LLMs在回答并发任务时保持了强大的实用性，这通过我们在数学和通用问答基准上的评估得到了证明，但我们显著观察到，将有害任务与良性任务结合会显著降低其被护栏过滤的概率，显示了LLMs中并发相关的潜在风险。基于这些发现，我们引入了\ exttt{JAIL-CON}，一种迭代攻击框架，通过任务并发（\underline{\ ext{CON}}currency）来\underline{\ ext{JAIL}}break（越狱）LLMs。在广泛使用的LLMs上的实验表明，与现有攻击相比，\ exttt{JAIL-CON}具有强大的越狱能力。此外，当护栏作为防御措施应用时，与先前攻击生成的顺序答案相比，我们\ exttt{JAIL-CON}中的并发答案表现出更大的隐蔽性，且更不易被护栏检测到，突显了任务并发在越狱LLMs中的独特特征。
英文摘要：
Despite their superior performance on a wide range of domains, large language models (LLMs) remain vulnerable to misuse for generating harmful content, a risk that has been further amplified by various jailbreak attacks. Existing jailbreak attacks mainly follow sequential logic, where LLMs understand and answer each given task one by one. However, concurrency, a natural extension of the sequential scenario, has been largely overlooked. In this work, we first propose a word-level method to enable task concurrency in LLMs, where adjacent words encode divergent intents. Although LLMs maintain strong utility in answering concurrent tasks, which is demonstrated by our evaluations on mathematical and general question-answering benchmarks, we notably observe that combining a harmful task with a benign one significantly reduces the probability of it being filtered by the guardrail, showing the potential risks associated with concurrency in LLMs. Based on these findings, we introduce $\texttt{JAIL-CON}$, an iterative attack framework that $\underline{\text{JAIL}}$breaks LLMs via task $\underline{\text{CON}}$currency. Experiments on widely-used LLMs demonstrate the strong jailbreak capabilities of $\texttt{JAIL-CON}$ compared to existing attacks. Furthermore, when the guardrail is applied as a defense, compared to the sequential answers generated by previous attacks, the concurrent answers in our $\texttt{JAIL-CON}$ exhibit greater stealthiness and are less detectable by the guardrail, highlighting the unique feature of task concurrency in jailbreaking LLMs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
