让蜜蜂找到薄弱点：针对LLMs的多轮越狱攻击的路径规划视角
Let the Bees Find the Weak Spots: A Path Planning Perspective on Multi-Turn Jailbreak Attacks against LLMs
AI总结：
本文将多轮越狱攻击抽象为路径规划问题，提出增强型人工蜂群算法ABC，通过协作搜索机制在大幅减少查询次数的同时，实现了90%以上的攻击成功率，有效降低了红队评估开销。
摘要：
大型语言模型（LLMs）已广泛应用于各种应用中，但其潜在的安全和伦理风险引发了越来越多的关注。现有研究采用红队评估，利用多轮越狱来识别LLMs中的潜在漏洞。然而，这些方法往往缺乏对攻击空间内成功对话轨迹的探索，并且倾向于忽略与攻击过程相关的巨大开销。为了解决这些局限性，本文首先引入了一个基于动态加权图拓扑的理论模型，将多轮攻击过程抽象为路径规划问题。基于这一框架，我们提出了ABC，一种用于多轮越狱的增强型人工蜂群算法，具有包含雇佣蜂、观察蜂和侦察蜂的协作搜索机制。该算法显著提高了最优攻击路径搜索的效率，同时大幅减少了所需的平均查询次数。在三个开源和两个专有语言模型上的实证评估证明了我们方法的有效性，在所有模型上实现了90%以上的攻击成功率，在GPT-3.5-Turbo上达到98%的峰值，并优于现有基线。此外，它平均仅需26次查询即可实现相当的成功率，显著降低了红队开销，突显了其卓越的效率。
英文摘要：
Large Language Models (LLMs) have been widely deployed across various applications, yet their potential security and ethical risks have raised increasing concerns. Existing research employs red teaming evaluations, utilizing multi-turn jailbreaks to identify potential vulnerabilities in LLMs. However, these approaches often lack exploration of successful dialogue trajectories within the attack space, and they tend to overlook the considerable overhead associated with the attack process. To address these limitations, this paper first introduces a theoretical model based on dynamically weighted graph topology, abstracting the multi-turn attack process as a path planning problem. Based on this framework, we propose ABC, an enhanced Artificial Bee Colony algorithm for multi-turn jailbreaks, featuring a collaborative search mechanism with employed, onlooker, and scout bees. This algorithm significantly improves the efficiency of optimal attack path search while substantially reducing the average number of queries required. Empirical evaluations on three open-source and two proprietary language models demonstrate the effectiveness of our approach, achieving attack success rates above 90\% across the board, with a peak of 98\% on GPT-3.5-Turbo, and outperforming existing baselines. Furthermore, it achieves comparable success with only 26 queries on average, significantly reducing red teaming overhead and highlighting its superior efficiency.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
