The fast advancements in Large Language Models (LLMs) are driving an increasing number of applications. Together with the growing number of users, we also see an increasing number of attackers who try to outsmart these systems. They want the model to reveal confidential information, specific false information, or offensive behavior. To this end, they manipulate their instructions for the LLM by inserting separators or rephrasing them systematically until they reach their goal. Our approach is different. It inserts words from the model vocabulary. We find these words using an optimization procedure and embeddings from another LLM (attacker LLM). We prove our approach by goal hijacking two popular open-source LLMs from the Llama2 and the Flan-T5 families, respectively. We present two main findings. First, our approach creates inconspicuous instructions and therefore it is hard to detect. For many attack cases, we find that even a single word insertion is sufficient. Second, we demonstrate that we can conduct our attack using a different model than the target model to conduct our attack with.

使用来自攻击模型的嵌入和优化过程插入模型词汇，我们证明了我们的方法可以成功劫持两个流行的开源大语言模型Llama2和Flan-T5，并显示了我们的方法具有不易被察觉的特点，且仅需插入单个词汇即可进行攻击，我们还证明可以使用不同于目标模型的模型进行攻击。

大规模语言模型应用的词汇攻击