arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2601.15331cs.CLcs.AIcs.CRcs.LG
收藏

RECAP:一种资源高效的对抗性提示方法用于大型语言模型

RECAP: A Resource-Efficient Method for Adversarial Prompting in Large Language Models

Rishit Chugh(独立研究者)

Rishit Chugh

AI总结:

RECAP提出一种无需重新训练的高效对抗性提示方法,通过匹配预训练对抗性提示数据库,降低计算成本并提升攻击成功率。

摘要:

大型语言模型(LLMs)的部署引发了安全担忧,因为它们在受到对抗性提示时容易产生有害或违反政策的输出。尽管对齐和防护措施可以缓解常见的滥用,但它们仍然容易受到自动化劫持方法如GCG、PEZ和GBDA的攻击,这些方法通过训练和基于梯度的搜索生成对抗性后缀。虽然这些方法有效,但尤其是GCG计算成本高,限制了资源受限组织的实用性。本文介绍了一种资源高效的对抗性提示方法,该方法通过匹配新提示到预先训练的对抗性提示数据库,消除了重新训练的需要。一个包含1000个提示的数据集被分类为七个有害类别,GCG、PEZ和GBDA在Llama 3 8B模型上进行评估,以确定每类攻击方法中最有效的攻击方法。结果揭示了提示类型与算法有效性之间的相关性。通过检索语义相似的成功对抗性提示,所提出的方法在显著降低计算成本的情况下实现了具有竞争力的攻击成功率。这项工作提供了一个可扩展的红色团队和对齐LLMs安全评估的实用框架,包括在模型内部不可访问的情况下。

英文摘要:

The deployment of large language models (LLMs) has raised security concerns due to their susceptibility to producing harmful or policy-violating outputs when exposed to adversarial prompts. While alignment and guardrails mitigate common misuse, they remain vulnerable to automated jailbreaking methods such as GCG, PEZ, and GBDA, which generate adversarial suffixes via training and gradient-based search. Although effective, these methods particularly GCG are computationally expensive, limiting their practicality for organisations with constrained resources. This paper introduces a resource-efficient adversarial prompting approach that eliminates the need for retraining by matching new prompts to a database of pre-trained adversarial prompts. A dataset of 1,000 prompts was classified into seven harm-related categories, and GCG, PEZ, and GBDA were evaluated on a Llama 3 8B model to identify the most effective attack method per category. Results reveal a correlation between prompt type and algorithm effectiveness. By retrieving semantically similar successful adversarial prompts, the proposed method achieves competitive attack success rates with significantly reduced computational cost. This work provides a practical framework for scalable red-teaming and security evaluation of aligned LLMs, including in settings where model internals are inaccessible.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑