Recently, Anil et al. (2024) show that many-shot (up to hundreds of)
demonstrations can jailbreak state-of-the-art LLMs by exploiting their
long-context capability. Nevertheless, is it possible to use few-shot
demonstrations to efficiently jailbreak LLMs within limited context sizes?
While the vanilla few-shot jailbreaking may be inefficient, we propose improved
techniques such as injecting special system tokens like [/INST] and employing
demo-level random search from a collected demo pool. These simple techniques
result in surprisingly effective jailbreaking against aligned LLMs (even with
advanced defenses). For examples, our method achieves >80% (mostly >95%) ASRs
on Llama-2-7B and Llama-3-8B without multiple restarts, even if the models are
enhanced by strong defenses such as perplexity detection and/or SmoothLLM,
which is challenging for suffix-based jailbreaking. In addition, we conduct
comprehensive and elaborate (e.g., making sure to use correct system prompts)
evaluations against other aligned LLMs and advanced defenses, where our method
consistently achieves nearly 100% ASRs. Our code is available at
this https URL

使用少量样本演示和特殊系统标记，通过随机搜索精确破解文本语言模型（LLMs），以获得高准确率的自动语音识别结果（ASRs）。