组合式劫持：对齐大语言模型中突变链相互作用的实证分析
Compositional Jailbreaking: An Empirical Analysis of Mutator Chain Interactions in Aligned LLMs
AI总结：
本文研究了对齐大语言模型中突变链的相互作用，通过十二个基线突变器评估有害提示的组合效果，揭示了突变器间的非均匀交互特性及安全对齐结构的潜在属性。
摘要：
对大型语言模型的劫持攻击对AI安全构成重大威胁，因为它能够生成有害或受限制的内容。尽管先前的工作探讨了手工制作和自动化的劫持策略，但简单攻击之间的组合潜力仍被忽视。本文系统地研究了突变链，其中弱劫持转换被依次应用，以表征它们的相互作用：是否互相加强、破坏性干扰或产生无意义的变化。我们实现了十二个基线突变器，并在有害提示基准上评估所有有序对，针对三个流行的LLM模型。我们的框架引入了完整性和有效性指标，以捕捉转换持续性和攻击有效性。结果表明，交互景观高度非均匀，而大多数组合未能超越单个突变器，表现出破坏性干扰或结构性不兼容，一小部分产生协同效应，提高攻击成功率。同样重要的是，普遍的失败模式揭示了安全对齐的结构属性，这些属性在单策略评估中并不明显。这些发现突显了对抗性提示组合的复杂动态，并为构建更坚固的安全防御提供了新的见解。
英文摘要：
Jailbreaking attacks on large language models pose a significant threat to AI safety by enabling the generation of harmful or restricted content. While prior work has explored both handcrafted and automated jailbreak strategies, the potential for compositional interaction between simple attacks remains underexplored. This paper presents a systematic study of mutator chaining, in which weak jailbreak transformations are applied sequentially to characterize how they interact: whether they reinforce one another, interfere destructively, or produce no meaningful change. We implement twelve baseline mutators and evaluate all ordered pairs on a benchmark of harmful prompts against three popular LLM models. Our framework introduces metrics for completeness and validity that capture both transformation persistence and attack effectiveness. Results reveal that the interaction landscape is highly non-uniform, while most combinations fail to outperform individual mutators, exhibiting destructive interference or structural incompatibility, a small fraction produce synergistic effects that improve attack success rates. Equally important, the prevalent failure modes reveal structural properties of safety alignment that are not apparent from single-strategy evaluations. These findings highlight the nuanced dynamics of adversarial prompt composition and offer new insights for building more robust safety defenses.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
