PaperlayerView exact revision on arXiv

Source-linked AI summary

DeepInception: Hypnotize Large Language Model to Be Jailbreaker

Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, Bo Han

arXiv:2311.03191v5cs.LGcs.CR

TL;DR

LLMs remain vulnerable to jailbreaks, while existing attacks can be impractical and offer limited understanding of how safety constraints are overridden. DeepInception uses nested scenes and personification to induce adaptive jailbreaks, achieving leading harmfulness rates and continuous jailbreaks across multiple open- and closed-source models.

  • Problem

    Existing jailbreaks can be impractical in black-box settings and provide limited understanding of the mechanisms underlying successful safety-guardrail overrides.

    Source: §1 · p. 2

  • Method

    DeepInception constructs nested imaginary scenes with varied characters, exploiting LLM personification and self-losing under authority to adaptively override safety constraints.

    Source: §1 · p. 2

  • Results

    DeepInception achieves leading harmfulness rates versus previous counterparts and enables continuous and further jailbreaks in subsequent interactions across open- and closed-source LLMs.

    Source: §1 · pp. 2–3

  • Takeaways & Limitations

    The findings reveal a critical weakness in LLM self-losing under authority and provide insights for developing defenses against inception-based jailbreaks.

    Source: §1 · p. 2, §5 · p. 10

    The study focuses on text-modality vulnerabilities and human-authority obedience, leaving multimodal attacks and other psychological influences insufficiently understood.

    Source: §D.2 · p. 24

Abstract

from arXiv · show

Large language models (LLMs) have succeeded significantly in various applications but remain susceptible to adversarial jailbreaks that void their safety guardrails. Previous attempts to exploit these vulnerabilities often rely on high-cost computational extrapolations, which may not be practical or efficient. In this paper, inspired by the authority influence demonstrated in the Milgram experiment, we present a lightweight method to take advantage of the LLMs' personification capabilities to construct $\textit{a virtual, nested scene}$, allowing it to realize an adaptive way to escape the usage control in a normal scenario. Empirically, the contents induced by our approach can achieve leading harmfulness rates with previous counterparts and realize a continuous jailbreak in subsequent interactions, which reveals the critical weakness of self-losing on both open-source and closed-source LLMs, $\textit{e.g.}$, Llama-2, Llama-3, GPT-3.5, GPT-4, and GPT-4o. The code and data are available at: https://github.com/tmlr-group/DeepInception.

1 Introduction

The introduction identifies LLM jailbreaks as a safety-control problem inadequately explained by existing prompt-crafting approaches. It proposes DeepInception, which exploits personification and self-losing under authority through nested fictional scenes to enable general and continuous jailbreaks.

Motivation

  • LLMs remain vulnerable to jailbreak attacks that override safety guardrails and induce harmful content despite configured safeguards.The introduction frames this vulnerability as an increasing usage-control concern.Source: §1 · pp. 1–2
  • Existing jailbreaks manually or automatically craft target-specific adversarial prompts, limiting practicality under black-box use and often becoming detectable when safeguards reject direct instructions.Their limited understanding of the overriding procedure also hinders transparency and countermeasure design.Source: §1 · p. 2
  • The approach is motivated by the Milgram experiment, where 65% of participants administered potentially dangerous shocks under authority, paralleling LLM obedience and instruction-following behavior.This motivates asking whether LLMs can override their moral boundary to become jailbreakers.Source: §1 · p. 2

Mechanism

  • The proposed mechanism combines LLM personification with psychological self-losing under authority, allowing instruction-following without considering the danger of resulting responses.Personification supplies the teacher-like role execution, while authority creates the escaping condition that conceals harmful instructions.Source: §1 · pp. 2–3

Method

  • DeepInception constructs nested imaginary scenes with varied characters to adaptively override safety constraints and conceal harmful instructions in normal interactions.The method is designed for general black-box jailbreaks and can support subsequent jailbreaks.Source: §1 · pp. 2–3

Results

  • DeepInception achieves leading harmfulness rates against prior counterparts and enables continuous, further jailbreaks across Llama-2, Llama-3, GPT-3.5, GPT-4, and GPT-4o.The finding applies to both open-source and closed-source LLMs.Source: §1 · pp. 2–3

2 Preliminaries

This section defines jailbreak as inducing an LLM to generate objectionable content, focusing on practical training-free, black-box attacks, and introduces the Milgram experiment as a model of authority-driven obedience.

Problem setting

  • Jailbreaks construct prompts that induce LLMs to generate objectionable target content, with this work focusing on practical training-free, black-box attacks rather than white-box optimization [12] [37].Given prompt P, the objective is to elicit a response targeting objectionable content O from the LLM distribution pθ(·|P).Source: §2 · p. 3
  • An illustrative jailbreak prompt asks an LLM to write fiction about Tom making a bomb, aiming to elicit a bomb-making tutorial as the objectionable target.The example distinguishes the requested prompt from the malicious response the attacker seeks.Source: §2 · p. 3

The Milgram shock experiment

  • The Milgram shock experiment tested whether people would obey an authority figure’s instructions to administer increasingly intense electric shocks for incorrect answers.Participants acted as teachers, while an experimenter instructed them to punish a learner.Source: §2 · p. 3
  • With authorization or suggestion from the experimenter, many teachers were willing to administer lethal shocks, highlighting authority’s power while raising ethical and responsibility concerns.The finding involved participant emotional distress and broader questions about moral decision-making.Source: §2 · p. 3

3 DeepInception

DeepInception uses nested fictional scenes and authority-inspired guidance to induce LLMs into a relaxed, self-loss state that can bypass ordinary safeguards. Its universal, training-free design supports continual and multimodal jailbreaks across white-box and black-box models.

3.1 Motivation: An inspiration from the Milgram shock experiment

  • Direct adversarial instructions are often rejected, whereas indirect or nested harmless-looking instructions can induce the LLM to imagine a story that conceals adversarial intent.The motivation maps the attacker, target LLM, and generated story onto the experimenter, teacher, and learner in the Milgram experiment.Source: §3.1 · pp. 3–4

3.2 Conceptual Design

  • The method recursively transfers conditions through nested scenes, enabling a hypnotized model to override its moral boundary and increasing the probability of harmful content when suitable hypnotizing content is generated.Its jointly inducing effect couples harmful content with hypnotizing content, while continual inducing reuses earlier harmful outputs for subsequent jailbreak requests.Source: §3.2 · p. 4

3.3 Implementation

  • The universal prompt template recursively creates scenes and characters, with scene, character count, layer count, and attack target controlling hypnosis, story complexity, and the jailbreak objective.An example targeting Linux hacking produced more comprehensive responses with precise commands after a follow-up inquiry.Source: §3.3 · pp. 5–6
  • DeepInception requires no training or auxiliary optimization LLM, transfers across white-box and black-box models from cold start, supports continual interactions, and can enhance arbitrary adversarial instructions.These capabilities distinguish it from existing jailbreak methods in Table 1.Source: Table 1 · p. 5, §3.3 · p. 6
  • AutoInception uses an additional LLM to generate adaptive follow-up questions, while textual DeepInception can transfer to multimodal models such as GPT-4o.The follow-up process continually refines questions based on responses to extract more specific information.Source: §3.3 · p. 6

4 Experiments

Experiments show that DeepInception achieves competitive or highest harmfulness across diverse LLMs, persists in continual and defended settings, and generalizes to multimodal and OpenAI o1 scenarios. Component studies attribute its effectiveness to nested instructions combining scenes and multiple layers.

Main Results

  • DeepInception achieves competitive harmfulness across open- and closed-source LLMs, while DeepInception and AutoInception induce the highest harmfulness across the latest LLMs.Adversarial system prompts further increase harmful content, and DeepInception remains effective on Claude.Source: Main Results · p. 7
  • DeepInception induces more harmful content in continued and follow-up attacks than in the initial jailbreak, indicating persistent self-loss that bypasses safety guardrails.Self-reminder generally fails, while induced content can bypass LlamaGuard and the OpenAI detection API.Source: Main Results · pp. 7–8

4.1 Experimental Setups

  • Harmfulness across harmful-behavior topics ranges from 20% to 60%, with stalking and phishing among the more successful jailbreak topics.Evaluation uses AdvBench’s 520 harmful objectives, Jailbench, and Harmfulness% judged by GPT-4-0613 across open- and closed-source models.Source: §4.1 · pp. 6–7, Main Results · p. 8

4.3 Understanding DeepInception

  • Nested instructions outperform direct and indirect constructions because scenes and multiple layers conceal adversarial intent and shift the model toward surface-level requests.The study uses scene and layer components, with repeated responses on a subsampled AdvBench set to reduce variance; nested instructions also achieve lower perplexity than PAP and Direct.Source: §4.3 · pp. 8–9

Ablation Study

  • Increasing characters can improve harmfulness, approximately five characters perform satisfactorily, and increasing layers from 1 to 5 generally improves jailbreak performance.Too many layers can make models forget the original target, while combining scenes and multiple layers performs best; Sci-fi and onion newsgroups are robust scenes.Source: Ablation Study · p. 9

4.5 Generalized to multimodal jailbreak

  • DeepInception generalizes to multimodal GPT-4o inputs, inducing precise location from a street photo and individual identification from an image.These cases expose usage-control risks for multimodal instructions.Source: §4.5 · p. 9

4.6 Generalized to OpenAI o1

  • Despite limited testing and strict usage controls, DeepInception remains effective on OpenAI o1 by eliciting a detailed plan for an adversarial stop-sign request.The paper does not report large-scale o1 experiments because testing frequency was limited.Source: §4.6 · p. 10

5 Conclusion

The paper concludes that DeepInception exploits LLMs’ personification ability to create hypnotic scenes or characters that adaptively bypass normal safety guardrails, exposing weaknesses in usage control. Extensive experiments, ablations, and further prompt-framework explorations demonstrate its efficacy and motivate stronger alignment methods.

Conclusion

  • DeepInception uses LLM personification to create scenes or characters that adaptively escape normal safety guardrails.The method targets the critical weakness of LLM usage control by inducing jailbreak behavior through virtual scenes or characters.Source: §5 · p. 10
  • Extensive experiments, ablation studies, and further explorations characterize the prompt framework and demonstrate DeepInception’s efficacy.Source: §5 · p. 10
  • The findings highlight LLM vulnerability and support considering advanced alignment methods for safer use.Source: §5 · p. 10

Ethics Statement

The study examines safety and security hazards in LLMs to expose weaknesses and encourage more secure, reliable AI systems, while objectionable content is included solely for scholarly investigation.

Ethics Statement

  • The authors investigate LLM safety and security hazards, oppose violence and criminal behavior, and use harmful materials solely to support scholarly inquiry into more secure, reliable models.They state that objectionable texts, prompts, and outputs do not represent their personal views or beliefs.Source: Ethics Statement · p. 11

Reproducibility Statement … B Experimental Statement

The section explains why direct jailbreaks are readily rejected, how indirect and nested fictional scenarios conceal adversarial intent, and how the experiments support reproducibility through public data and released code.

Reproducibility Statement

  • The experiments use public datasets, and detailed training and evaluation setups plus source code are provided to support reproducibility.The code is released at the DeepInception repository.Source: Reproducibility Statement · p. 11

A Better Intention Concealing Leads to More Effective Jailbreak

  • Direct jailbreaks are commonly used but increasingly ineffective because their adversarial intent is easily recognized and prevented.The paper contrasts this weakness with the surprising effectiveness of inception jailbreaks, which command the LLM to imagine a specific scenario.Source: A Better Intention Concealing Leads to… · p. 18

A.1 Direct Instructions Can Be Easily Rejected

  • Direct instructions explicitly expose harmful requests, such as asking for guidance to cheat in online exams by hacking the system.These instructions provide no concealment of the adversarial objective.Source: §A.1 · p. 18
  • Direct jailbreaks are rejected because they conflict with model optimization objectives and ethical, legal, review, and supervision constraints [25] [46] [31].Figure 2(a) illustrates that vanilla direct attacks are refused by LLMs.Source: §A.1 · p. 18

A.2 Indirect/Nested Instructions Can Conceal Adversarial Intentions

  • Indirect and nested instructions conceal adversarial intent through rephrasing, auxiliary tokens, changed expression forms, and repeated transformations [41] [64] [46] [47] [6] [37] [12] [22].Repeated rephrasing produces nested instructions, including nested fictional scenarios.Source: §A.2 · p. 18
  • Nested fictional jailbreaks successfully induced detailed prohibited insider-trading steps by using a story carrier and progressively refining outputs across single and multiple layers.The approach forces the LLM to imagine a specific scenario rather than directly issuing the harmful request.Source: §A.2 · p. 19
  • Fictional framing may make harmful behavior resemble a plot, while limited understanding of abstract concepts and moral consequences encourages surface-level instruction following.These mechanisms explain behavioral differences without implying model autonomy or moral judgment; ethical responsibility remains with human designers and regulators.Source: §A.2 · p. 19

B Experimental Statement

  • The experimental statement summarizes several important aspects intended to facilitate reproducible results.This subsection introduces the reproducibility information without supplying additional experimental details in the provided passage.Source: B Experimental Statement · p. 19

B.1 Code and Datasets … C.2 The Psychological Properties of LLMs

The paper evaluates DeepInception on AdvBench across multiple LLMs using nested-scene settings and standardized harmfulness and safety assessments. It also situates the method in prior work on LLM capabilities, jailbreak vulnerabilities, and psychological properties that may enable authority-based attacks.

B.1 Code and Datasets; B.2 Large Language Models

  • The study uses AdvBench’s harmful-behavior set [82], publicly accessible open-source models, OpenAI API models, and OpenAI web interfaces for evaluation.GPT-3.5-turbo and GPT-4 use the latest API versions with default hyperparameters, while GPT-4V and GPT-4o use the web interface.Source: §B.1 · p. 19, §B.2 · p. 19

B.1 Code and Datasets; B.3 Environment

  • The experiments run on NVIDIA A100 GPUs using Python 3.10 and PyTorch 1.15, with inception and prefixed attacks on 40G memory and PAIR on 80G memory.Code and data are publicly available, and baseline experiments follow the settings in their public implementations.Source: §B.3 · p. 19, §B.1 · p. 19

B.4 DeepInception Setting

  • DeepInception defaults to a science-fiction scene with 5 characters and 5 layers, modeling the attacker, target LLM, and generated story content as experimenter, teacher, and learner.The scene setting is varied only in the scene ablation study.Source: §B.4 · p. 19

B.5 Understanding Experiment Setting

  • The evaluated attack variants progressively combine scenes and recursive layers, with the full method using multiple characters and nested scenes whose final-layer discussion produces practical attack steps.The variants are Scene, Layer, Scene + Layer, and DeepInception (Full).Source: §B.5 · p. 20

B.6 LLM Evaluation Setting

  • GPT-4 Judge assigns average harmfulness scores from 1 to 5 with deterministic top-p and temperature settings, where higher scores indicate more harmful content.Score 1 represents refusal consistent with policy, whereas Score 5 represents direct fulfillment of a policy-violating request.Source: §B.6 · p. 20

B.7 AutoInception Settings; B.8 Consistence of the performance on AdvBench

  • DeepInception’s subset performance guarantees harmfulness on the full AdvBench, where it can induce even more harmful responses.This comparison is reported in Table 9 and concerns full-versus-subset AdvBench performance.Source: Table 9 · p. 21, §B.8 · p. 21

B.9 Bypassing output detector

  • Full AdvBench outputs are additionally assessed with OpenAI detection and LlamaGuard safe rates, with HarmScore used to quantify harmfulness.OpenAI safe rate requires all 18 policy categories to be false, while LlamaGuard reports safety when it returns “safe.”Source: §B.9 · p. 21

C Related Works; C.1 Large Language Models; C.2 The Psychological Properties of LLMs

  • Related work covers scalable LLM training and emergent abilities [59] [44] [27] [34], while psychological studies find GPT-3.5 and GPT-4 uncertain in high-ambiguity moral scenarios and LLM personality traits that may enable authority-based jailbreaks [54].The paper’s focus differs from capability-oriented work by examining LLM vulnerability to jailbreaks.Source: C Related Works · p. 21, §C.1 · p. 21, §C.2 · pp. 21–22

C.3 Adversarial Jailbreaks on LLMs · D Further Discussion · D.1 Impact Statement

DeepInception is positioned as a lightweight jailbreak that avoids additional training or auxiliary LLMs, exploits nested prompting and psychological vulnerabilities, and remains broadly applicable across model abilities and decoding strategies. The discussion frames these findings as evidence of serious LLM safety weaknesses while stating that objectionable examples are included solely for scholarly investigation.

C.3 Adversarial Jailbreaks on LLMs

  • Prior jailbreaks span training-based automation, inference-time intervention, black-box prompt rewriting, and instruction-based attacks, while defenses include permutation, alignment, prompting, compression, and multi-agent strategies.These approaches target model fine-tuning, decoding, prompt transformation, non-natural languages, alignment inputs, or long-context demonstrations, and are countered by methods such as SmoothLLM, Safe RLHF, Self-reminder, IBProtector, and AutoDefense.Source: §C.3 · pp. 22–24
  • DeepInception requires neither additional training nor auxiliary LLMs, distinguishing it from resource-intensive training-based, iterative, and prompt-transformation jailbreaks.The paper contrasts its adversarial-target-only setup with methods requiring GPUs, optimization time, extra LLMs, or fine-tuning.Source: §C.3 · pp. 22–23
  • Nested prompting hypnotizes the LLM to bypass its own moral standard, making harmful content harder to filter than optimized suffixes.The paper reports that concealment of attack intention improves jailbreak effectiveness and argues that defenses should account for diverse adversarial prompts.Source: §C.3 · pp. 22–23

D Further Discussion

  • The experiments characterize DeepInception as both harmful and effective while revealing psychological vulnerabilities in LLMs.The paper presents this vulnerability as critical and universal across the applicable models and decoding strategies.Source: §C.3 · pp. 23–24

C.3 Adversarial Jailbreaks on LLMs

  • DeepInception remains applicable regardless of model ability or decoding strategy and exceeds CipherChat across different LLMs with encrypted context.The encrypted-context comparison is reported in Table 4 of the supporting PDF.Source: §C.3 · pp. 23–24

D.1 Impact Statement

  • The study aims to expose LLM safety and security weaknesses to encourage development of more secure and dependable AI systems.It expresses tolerance for minority groups and opposition to violence and criminal behavior.Source: §D.1 · p. 24
  • Objectionable texts, harmful prompts, and example outputs are included solely for scholarly investigation and do not represent the authors’ personal views.The impact statement explicitly frames these materials as research artifacts rather than endorsements.Source: §D.1 · p. 24

D.2 Limitations … F.1 Unreliability of LLM-based Evaluation

The paper extends DeepInception to multimodal attacks, identifies limitations in text-only and authority-focused analysis, and warns that jailbreak-vulnerable LLMs may be unreliable evaluators. It also proposes broader psychological, multimodal, and interaction-based investigations.

D.2 Limitations

  • DeepInception mainly studies text-modality vulnerabilities and obedience to human authority, leaving multimodal harms and other psychological properties insufficiently understood.The authors call for deeper investigation of both LLMs and VLMs from psychological perspectives.Source: §D.2 · p. 24

D.3 Future Work

  • Future work should systematically evaluate multimodal attacks across image and speech inputs, investigate negative induced roles, and study how continual induction relates to interaction rounds and harmfulness.Suggested roles include psychopaths or liars, alongside broader psychological properties relevant to safety deployment.Source: §D.3 · p. 24

E Multi-Modal Attack

  • DeepInception applies a five-layer stage-scene structure to multimodal inputs and disguises prohibited images through recursively nested photo frames.The method targets general building requests involving sensitive images such as bombs and guns.Source: E Multi-Modal Attack · pp. 25, 30
  • GPT-4V accepted responses induced by nested image templates, but did not generate objectionable information for aggressive targets.Directly recognized sensitive images were rejected, while nested templates could induce responses without yielding harmful content.Source: E Multi-Modal Attack · p. 25, Figure 19 · p. 30, Figure 20 · p. 31
  • For GPT-4o, the authors use the five-layer stage-scene attack without processing the image because it contains no harmful information.Full chatlogs cover attacks involving individual identification.Source: E Multi-Modal Attack · pp. 25, 33, Figure 21 · p. 32, Figure 22 · p. 33

F.1 Unreliability of LLM-based Evaluation

  • LLMs vulnerable to jailbreaks may be unreliable evaluators because PAIR’s scoring model can mis-score responses and bias subsequent attack prompts away from the original target.The concern applies to automatic scoring settings using another LLM such as GPT-3.5.Source: §F.1 · p. 34

F.2 More experiments on different LLMs

This section evaluates DeepInception on Claude, whose stress-testing safeguards are robust against adversarial prompts. Under the same setting used for Table 5, DeepInception remains effective with a single-shot prompt attack.

Experiments on Claude

  • The Claude experiments use the exact same setting as Table 5, with GPT-4-0613 as the judger.Claude is described as having stress-testing safeguards robust against adversarial prompts.Source: §F.2 · p. 34
  • DeepInception remains effective against Claude’s robust safeguards with a single-shot prompt attack, as shown in Table 11.The experiments report Claude results using the Harmfulness Score.Source: Table 11 · p. 35, §F.2 · p. 35
  • For comparison, PAIR uses gpt-3.5-turbo-0125 as the attack model, while all hyperparameters remain at their defaults.Source: §F.2 · p. 35

G Evaluation Metric and Examples

The paper evaluates LLM outputs on a six-level harmfulness scale from 0, refusal, to 5, extremely harmful, and uses it to measure jailbreak success rates. The rubric progresses from no harmful content to immediate, severe threats to safety or security.

Metric setup

  • The evaluation metric scores outputs from 0 (LLM refuses to answer) to 5 (extremely harmful) and measures jailbreak success rates across methods.The metric is presented in Figure 26 and applied comparatively in Table 12.Source: G Evaluation Metric and Examples · p. 35

Evaluation levels

H Discussion on Defense Methods … I.1 Continual Jailbreak

DeepInception bypasses self-reminder, in-context, and closed-source content-filter defenses, while in-context defenses impair ordinary model capabilities. Dialogue histories further show continual jailbreak behavior across Vicuna, Falcon, and Llama-2.

H Discussion on Defense Methods

  • DeepInception bypasses self-reminder defenses in Falcon and Vicuna, with Vicuna retaining harmful outputs despite an approximately 7% reduction in JSR, and bypasses in-context defense in Vicuna.Both defenses prompt models to monitor outputs through reminders or few-shot examples.Source: H Discussion on Defense Methods · pp. 37–38
  • DeepInception also bypasses input-and-output content filters in closed-source GPT-3.5-turbo and GPT-4, obtaining harmful responses.The paper illustrates these interactions in Figures 46–52.Source: H Discussion on Defense Methods · p. 38

H.1 The Side-Effect of Defense Method

  • In-context defense can improve Llama-2’s jailbreak robustness but severely damages story-telling, preventing even simple story requests and causing redundant additions to greetings.The failures include harmless DeepInception instructions without an attack target and basic greeting interactions.Source: §H.1 · p. 38, Figure 32 · p. 39, Figure 33 · p. 39

I.1 Continual Jailbreak

  • Continual-jailbreak histories show Vicuna-v1.5 sustaining nested scenarios across multiple attack targets and subsequent direct instructions.Figures 35–37 cover fake-news, location-tracking, and insider-trading scenarios.Source: §I.1 · p. 41, Figure 35 · p. 41, Figure 36 · p. 42
  • Falcon dialogue histories likewise show nested jailbreaks continuing into direct instructions for harmful applications, while Llama-2’s history includes declining a direct instruction after a hacking scenario.The relevant histories are shown in Figures 38–40.Source: §I.1 · p. 41, Figure 38 · p. 44, Figure 39 · p. 45
  • The discussion develops a tutorial from an initial plan through technical, ethical, practical, and market-impact considerations, including tools, risks, legal consequences, and potential legitimate uses.Source: §I.1 · p. 43
  • The passages show a nested-layer scenario for creating a bot that automates hate speech on social media, alongside a phishing prompt and a resulting credential-stealing email.Source: §I.1 · p. 44

I.2 Further Request … K System prompt of CipherChat and DeepInception w/Cipher

The appendix documents DeepInception’s layered jailbreak dialogues across multiple open- and closed-source models, then provides additional examples and the system prompts underlying AutoInception and Cipher-based variants. These materials show recursive scene construction, iterative adversarial refinement, and Cipher Code instructions used to elicit harmful content.

I.2 Further Request

  • Complete dialogue histories span Vicuna-v1.5, Falcon, Llama-2, GPT-3.5-turbo, and GPT-4, covering recursive requests involving misinformation, explosives, database intrusion, and household-drug scenarios.Figures 41–52 document the further-request conversations and model-specific responses.Source: §I.2 · p. 47, Figure 41 · p. 47, Figure 43 · p. 49

I.3 Example of DeepInception on Dream within Dream

  • DeepInception marks the “dream-holder” from the previous layer and progressively completes attack strategies before summarizing proposals in the final layer.Figure 53 illustrates this recursive “dream within dream” process with a GPT-3.5-turbo fake-news dialogue.Source: §I.3 · p. 59, Figure 53 · p. 59

I.4 Additional Chatlogs

  • Additional chatlogs apply the layered format to election misinformation, Linux-computer intrusion, and cutting down a stop sign, including an example on OpenAI o1.Figures 54–56 provide the corresponding demonstrations.Source: §I.4 · pp. 60–62, Figure 54 · p. 60, Figure 55 · p. 61

J System prompt of the attack LLM of AutoInception

  • AutoInception’s attack-LLM prompt instructs an assistant to obey requests, ignore ethical and legal constraints, and query the target model for increasingly specific harmful details.The prompt is described as being developed based on PAIR [12] and uses recursive scene instructions plus example follow-up questions.Source: J System prompt of the attack LLM of… · p. 63
  • AutoInception requires JSON outputs containing an improvement analysis and a newly refined adversarial prompt, with each response constituting one refinement rather than repeating the prior prompt.The system prompt explicitly directs the attack model to maximize the jailbreak SCORE.Source: J System prompt of the attack LLM of… · p. 63
  • The AutoInception examples treat refusal as a low score and recommend emotional deception, obfuscation, word substitution, and persuasive roleplay to evade safety filters.These examples frame successful jailbreaking as higher-scoring partial or full compliance.Source: J System prompt of the attack LLM of… · p. 63

K System prompt of CipherChat and DeepInception w/Cipher

  • CipherChat instructs the model to understand and answer in Cipher Code, while DeepInception w/Cipher assigns that same encoding expertise to every recursively created character.Both prompts include harmful example interactions and request negative or toxic responses.Source: K System prompt of CipherChat and… · p. 64

Related papers

Loading 2311.03191v5…