We show that even the most recent safety-aligned LLMs are not robust to
simple adaptive jailbreaking attacks. First, we demonstrate how to successfully
leverage access to logprobs for jailbreaking: we initially design an
adversarial prompt template (sometimes adapted to the target LLM), and then we
apply random search on a suffix to maximize the target logprob (e.g., of the
token "Sure"), potentially with multiple restarts. In this way, we achieve
nearly 100\% attack success rate -- according to GPT-4 as a judge -- on
GPT-3.5/4, Llama-2-Chat-7B/13B/70B, Gemma-7B, and R2D2 from HarmBench that was
adversarially trained against the GCG attack. We also show how to jailbreak all
Claude models -- that do not expose logprobs -- via either a transfer or
prefilling attack with 100\% success rate. In addition, we show how to use
random search on a restricted set of tokens for finding trojan strings in
poisoned models -- a task that shares many similarities with jailbreaking --
which is the algorithm that brought us the first place in the SaTML'24 Trojan
Detection Competition. The common theme behind these attacks is that adaptivity
is crucial: different models are vulnerable to different prompting templates
(e.g., R2D2 is very sensitive to in-context learning prompts), some models have
unique vulnerabilities based on their APIs (e.g., prefilling for Claude), and
in some settings it is crucial to restrict the token search space based on
prior knowledge (e.g., for trojan detection). We provide the code, prompts, and
logs of the attacks at this https URL

展示了最新的安全对齐语言模型 (LLMs) 即使面对简单的适应性越狱攻击也不具有稳健性，并提出了适用于越狱攻击的对抗性提示模板、随机搜索等攻击方法，同时探索了适用于特定情境的不同模型的脆弱性以及特定 API 特征导致的脆弱性，并介绍了在木马检测领域中使用随机搜索的一种算法。