Adversarial misuse, particularly through `jailbreaking' that circumvents a
model's safety and ethical protocols, poses a significant challenge for Large
Language Models (LLMs). This paper delves into the mechanisms behind such
successful attacks, introducing a hypothesis for the safety mechanism of
aligned LLMs: intent security recognition followed by response generation.
Grounded in this hypothesis, we propose CodeChameleon, a novel jailbreak
framework based on personalized encryption tactics. To elude the intent
security recognition phase, we reformulate tasks into a code completion format,
enabling users to encrypt queries using personalized encryption functions. To
guarantee response generation functionality, we embed a decryption function
within the instructions, which allows the LLM to decrypt and execute the
encrypted queries successfully. We conduct extensive experiments on 7 LLMs,
achieving state-of-the-art average Attack Success Rate (ASR). Remarkably, our
method achieves an 86.6\% ASR on GPT-4-1106.

通过引入个性化加密策略的新型越狱框架 CodeChameleon，本研究研究了对大型语言模型（LLMs）的安全和伦理协议进行绕过的敌对滥用，提出了基于意图安全识别和响应生成的安全机制假设。我们通过将任务转化为代码完成格式，使用户能够使用个性化加密函数对查询进行加密，以避开意图安全识别阶段。为保证响应生成功能，我们在指令中嵌入了一个解密函数，允许 LLM 成功解密和执行加密的查询。在 7 个 LLM 上进行了广泛的实验，取得了最先进的平均攻击成功率（ASR），其中在 GPT-4-1106 上达到了 86.6％的 ASR。