Large Language Models (LLMs) are aligned to moral and ethical guidelines but
remain susceptible to creative prompts called Jailbreak that can bypass the
alignment process. However, most jailbreaking prompts contain harmful questions
in the natural language (mainly English), which can be detected by the LLM
themselves. In this paper, we present jailbreaking prompts encoded using
cryptographic techniques. We first present a pilot study on the
state-of-the-art LLM, GPT-4, in decoding several safe sentences that have been
encrypted using various cryptographic techniques and find that a
straightforward word substitution cipher can be decoded most effectively.
Motivated by this result, we use this encoding technique for writing
jailbreaking prompts. We present a mapping of unsafe words with safe words and
ask the unsafe question using these mapped words. Experimental results show an
attack success rate (up to 59.42%) of our proposed jailbreaking approach on
state-of-the-art proprietary models including ChatGPT, GPT-4, and Gemini-Pro.
Additionally, we discuss the over-defensiveness of these models. We believe
that our work will encourage further research in making these LLMs more robust
while maintaining their decoding capabilities.

大型语言模型容易受到称为 Jailbreak 的创新提示的影响，本文提出使用加密技术对越狱提示进行编码，实验结果表明我们提出的越狱方法在 ChatGPT、GPT-4 和 Gemini-Pro 等先进专有模型上的攻击成功率高达 59.42％，此外，我们还讨论了这些模型的过度防御性。