Deciphering the Chaos: Enhancing Jailbreak Attacks via Adversarial Prompt Translation

2024-10-15

arXiv.org

AI Summary

Existing adversarial prompts are predominantly gradient-generated gibberish—semantically ambiguous and poorly readable—resulting in weak cross-model transferability and limited attack generalization. This paper introduces the first interpretable adversarial prompt translation paradigm, which “translates” nonsensical prompts into semantically coherent, natural-language adversarial prompts of high quality, preserving attack strength while significantly enhancing transferability. Methodologically, we integrate gradient-based optimization, semantic-constrained decoding, and large language model (LLM)-driven self-supervised translation into an end-to-end translation framework. Experiments demonstrate state-of-the-art performance: 81.8% average attack success rate across seven closed-source commercial models (GPT/Claude-3 series) on HarmBench within ≤10 queries; over 90% success against the robust Llama-2-Chat on AdvBench—substantially outperforming prior art. Our work advances semantic-level understanding of jailbreak mechanisms and establishes a new foundation for interpretable, transferable adversarial prompting.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Computer Vision: Adversarial Attacks & Robustness
• Natural Language Processing: Prompt Engineering / Prompting

Application Category

• Search and Retrieval-Augmented AI: Large language models for search
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Automatic adversarial prompt generation provides remarkable success in jailbreaking safely-aligned large language models (LLMs). Existing gradient-based attacks, while demonstrating outstanding performance in jailbreaking white-box LLMs, often generate garbled adversarial prompts with chaotic appearance. These adversarial prompts are difficult to transfer to other LLMs, hindering their performance in attacking unknown victim models. In this paper, for the first time, we delve into the semantic meaning embedded in garbled adversarial prompts and propose a novel method that"translates"them into coherent and human-readable natural language adversarial prompts. In this way, we can effectively uncover the semantic information that triggers vulnerabilities of the model and unambiguously transfer it to the victim model, without overlooking the adversarial information hidden in the garbled text, to enhance jailbreak attacks. It also offers a new approach to discovering effective designs for jailbreak prompts, advancing the understanding of jailbreak attacks. Experimental results demonstrate that our method significantly improves the success rate of jailbreak attacks against various safety-aligned LLMs and outperforms state-of-the-arts by large margins. With at most 10 queries, our method achieves an average attack success rate of 81.8% in attacking 7 commercial closed-source LLMs, including GPT and Claude-3 series, on HarmBench. Our method also achieves over 90% attack success rates against Llama-2-Chat models on AdvBench, despite their outstanding resistance to jailbreak attacks. Code at: https://github.com/qizhangli/Adversarial-Prompt-Translator.

Problem

• Adversarial Text Generation
• Large Language Models
• Attack Efficiency

Innovation

• Special Text Transformation
• Security Model Attack
• Keyword Utilization