对齐以错位：基于元优化LLM评判者的自动LLM劫持
Align to Misalign: Automatic LLM Jailbreak with Meta-Optimized LLM Judges
AI总结：
本文提出AMIS框架，通过双层结构联合优化劫持提示和评分模板，提升LLM劫持效果，实测在AdvBench和JBB-Behaviors上取得最佳性能。
摘要：
识别大型语言模型（LLM）的漏洞对于通过解决固有弱点来提高其安全性至关重要。劫持，即攻击者通过精心设计的输入提示绕过安全措施，是红队测试中探测LLM以引发意外或不安全行为的核心。最近的基于优化的劫持方法通过利用LLM迭代优化攻击提示。然而，它们通常依赖于二元攻击成功率（ASR）信号，这些信号稀疏，或手动编写的评分模板，这些会引入人为偏差和评分结果的不确定性。为了解决这些限制，我们引入了AMIS（对齐以错位），一种元优化框架，通过双层结构联合演化劫持提示和评分模板。在内循环中，提示通过固定评分模板的细粒度和密集反馈进行优化。在外循环中，模板通过ASR对齐分数进行优化，逐渐演变以更好地反映查询中的真实攻击结果。这种协同优化过程产生越来越强的劫持提示和更校准的评分信号。在AdvBench和JBB-Behaviors上的评估表明，AMIS实现了最先进的性能，包括在Claude-3.5-Haiku上的88.0% ASR和在Claude-4-Sonnet上的100.0% ASR，显著优于现有基线。
英文摘要：
Identifying the vulnerabilities of large language models (LLMs) is crucial for improving their safety by addressing inherent weaknesses. Jailbreaks, in which adversaries bypass safeguards with crafted input prompts, play a central role in red-teaming by probing LLMs to elicit unintended or unsafe behaviors. Recent optimization-based jailbreak approaches iteratively refine attack prompts by leveraging LLMs. However, they often rely heavily on either binary attack success rate (ASR) signals, which are sparse, or manually crafted scoring templates, which introduce human bias and uncertainty in the scoring outcomes. To address these limitations, we introduce AMIS (Align to MISalign), a meta-optimization framework that jointly evolves jailbreak prompts and scoring templates through a bi-level structure. In the inner loop, prompts are refined using fine-grained and dense feedback from a fixed scoring template. In the outer loop, the template is optimized using an ASR alignment score, gradually evolving to better reflect true attack outcomes across queries. This co-optimization process yields progressively stronger jailbreak prompts and more calibrated scoring signals. Evaluations on AdvBench and JBB-Behaviors demonstrate that AMIS achieves state-of-the-art performance, including 88.0% ASR on Claude-3.5-Haiku and 100.0% ASR on Claude-4-Sonnet, outperforming existing baselines by substantial margins.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
