BAIT: 基于边界引导的自我条件推理披露升级
BAIT: Boundary-Guided Disclosure Escalation LLM Jailbreaking via Self-Conditioned Reasoning
AI总结：
提出BAIT三步越狱框架，通过识别保护边界、细化边界和请求详细示例，利用模型自身推理和一致性倾向实现恶意目标披露，实验表明在多个基准上攻击成功率显著优于传统方法。
摘要：
在这项工作中，我们提出了BAIT（边界感知迭代陷阱），一个三步越狱框架，通过内部披露接近恶意目标。BAIT首先要求模型识别保护边界，然后要求其细化该边界，最后请求一个详细示例。通过在每个步骤中扩展模型之前的响应，BAIT将模型自身的推理和一致性倾向转变为披露路径。在AdvBench、JailbreakBench、AIR-Bench和SORRY-Bench上的实验表明，BAIT在顶级大语言模型上持续实现高攻击成功率，显著超越了传统的越狱基线。进一步分析揭示：1）预防导向的框架显著优于直接知识请求；2）细化步骤在披露升级中起关键作用；3）前两步有一定概率引发有害内容，同时触发很少的过滤。
英文摘要：
In this work, we propose BAIT (Boundary-Aware Iterative Trap), a three-step jailbreak framework that elicits malicious information through internal disclosure by target large language models (LLMs), instead of external feedback from judge LLMs. BAIT first asks the model to identify the protection boundary, then requires it to refine that boundary, and finally requests a detailed example. By expanding each step upon the model's previous responses, BAIT turns the model's own reasoning and consistency tendency into a disclosure pathway. Experiments on AdvBench, JailbreakBench, AIR-Bench, and SORRY-Bench demonstrate that BAIT consistently achieves strong attack success rates across top-tier large language models, significantly advancing conventional jailbreak baselines. Further analysis reveals that: 1) prevention-oriented framing significantly outperforms direct knowledge requests; 2) the refinement step plays a critical role in disclosure escalation; and 3) the first two steps have a certain chance of eliciting harmful content while triggering little filtering. These findings underscore the necessity of safeguarding against internally driven reasoning trajectories that progressively cross safety boundaries.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
