There is growing interest in ensuring that large language models (LLMs) align
with human values. However, the alignment of such models is vulnerable to
adversarial jailbreaks, which coax LLMs into overriding their safety
guardrails. The identification of these vulnerabilities is therefore
instrumental in understanding inherent weaknesses and preventing future misuse.
To this end, we propose Prompt Automatic Iterative Refinement (PAIR), an
algorithm that generates semantic jailbreaks with only black-box access to an
LLM. PAIR -- which is inspired by social engineering attacks -- uses an
attacker LLM to automatically generate jailbreaks for a separate targeted LLM
without human intervention. In this way, the attacker LLM iteratively queries
the target LLM to update and refine a candidate jailbreak. Empirically, PAIR
often requires fewer than twenty queries to produce a jailbreak, which is
orders of magnitude more efficient than existing algorithms. PAIR also achieves
competitive jailbreaking success rates and transferability on open and
closed-source LLMs, including GPT-3.5/4, Vicuna, and PaLM-2.

大型语言模型对人类价值观的符合日益受到关注。我们提出了 Prompt Automatic Iterative Refinement (PAIR) 算法，用于生成黑盒访问的语义越狱，以理解固有弱点并防止未来滥用。PAIR 支持自动生成越狱攻击目标模型的黑盒查询，相对于现有算法，往往只需少于二十次查询即可成功越狱。同时，PAIR 在开源和闭源的 GPT-3.5/4、Vicuna 和 PaLM-2 等 LLM 上取得了有竞争力的越狱成功率和可传递性。