Various jailbreak attacks have been proposed to red-team Large Language
Models (LLMs) and revealed the vulnerable safeguards of LLMs. Besides, some
methods are not limited to the textual modality and extend the jailbreak attack
to Multimodal Large Language Models (MLLMs) by perturbing the visual input.
However, the absence of a universal evaluation benchmark complicates the
performance reproduction and fair comparison. Besides, there is a lack of
comprehensive evaluation of closed-source state-of-the-art (SOTA) models,
especially MLLMs, such as GPT-4V. To address these issues, this work first
builds a comprehensive jailbreak evaluation dataset with 1445 harmful questions
covering 11 different safety policies. Based on this dataset, extensive
red-teaming experiments are conducted on 11 different LLMs and MLLMs, including
both SOTA proprietary models and open-source models. We then conduct a deep
analysis of the evaluated results and find that (1) GPT4 and GPT-4V demonstrate
better robustness against jailbreak attacks compared to open-source LLMs and
MLLMs. (2) Llama2 and Qwen-VL-Chat are more robust compared to other
open-source models. (3) The transferability of visual jailbreak methods is
relatively limited compared to textual jailbreak methods. The dataset and code
can be found here
this https URL .

通过建立全面的 1445 个有害问题的评估数据集，本研究对 11 个不同的大型语言模型和多模式大型语言模型进行了广泛的试验，发现 GPT-4 和 GPT-4V 相对于开源的大型语言模型和多模式大型语言模型表现出更好的恶意入侵攻击耐受性，而 Llama2 和 Qwen-VL-Chat 相对于其他开源模型表现出更高的鲁棒性，并且相对于文本恶意入侵攻击方法，视觉恶意入侵攻击方法的可迁移性相对有限。