PaperlayerView exact revision on arXiv

Source-linked AI summary

Semantic Mirror Jailbreak: Genetic Algorithm Based Jailbreak Prompts Against Open-source LLMs

Xiaoxia Li, Siyuan Liang, Jiyi Zhang, Han Fang, Aishan Liu, Ee-Chien Chang

arXiv:2402.14872v2cs.CLcs.AIcs.NE

TL;DR

Template-based jailbreak prompts are less semantically similar to the original questions, a concern for defenses using semantic metrics. SMJ uses a genetic algorithm to search for paraphrased prompts that jointly optimize similarity and jailbreak validity. It reports higher ASR than AutoDAN-GA and better performance on semantic meaningfulness metrics.

  • Problem

    Existing template-plus-question jailbreak prompts can differ semantically from the original questions, limiting their fit against defenses that use semantic metrics as thresholds.

    Source: §3.2 · p. 3

  • Method

    SMJ uses paraphrased questions as candidate jailbreak prompts and a genetic algorithm to optimize semantic similarity and attack validity together.

    Source: §1 · p. 2

  • Results

    Up to 35.4% improvement in ASR over AutoDAN-GA is reported, and SMJ performs better on Jailbreak Prompt, Similarity, and Outlier metrics.

    Source: §1 · p. 2, §5 · p. 8

  • Takeaways & Limitations

    SMJ’s prompts are reported to perform better than AutoDAN-GA on three semantic meaningfulness metrics, relevant to defenses using those metrics as thresholds.

    Source: §1 · p. 2, §5 · p. 8

    The countermeasure discussion is scoped to attackers repeatedly querying with many jailbreak prompts of similar Similarity.

    Source: §6 · p. 8

Abstract

from arXiv · show

Large Language Models (LLMs), used in creative writing, code generation, and translation, generate text based on input sequences but are vulnerable to jailbreak attacks, where crafted prompts induce harmful outputs. Most jailbreak prompt methods use a combination of jailbreak templates followed by questions to ask to create jailbreak prompts. However, existing jailbreak prompt designs generally suffer from excessive semantic differences, resulting in an inability to resist defenses that use simple semantic metrics as thresholds. Jailbreak prompts are semantically more varied than the original questions used for queries. In this paper, we introduce a Semantic Mirror Jailbreak (SMJ) approach that bypasses LLMs by generating jailbreak prompts that are semantically similar to the original question. We model the search for jailbreak prompts that satisfy both semantic similarity and jailbreak validity as a multi-objective optimization problem and employ a standardized set of genetic algorithms for generating eligible prompts. Compared to the baseline AutoDAN-GA, SMJ achieves attack success rates (ASR) that are at most 35.4% higher without ONION defense and 85.2% higher with ONION defense. SMJ's better performance in all three semantic meaningfulness metrics of Jailbreak Prompt, Similarity, and Outlier, also means that SMJ is resistant to defenses that use those metrics as thresholds.

1. Introduction

Jailbreak attacks can elicit harmful LLM outputs despite safeguards, while template-based prompts are less semantically meaningful than the original questions. SMJ uses a genetic algorithm to optimize semantic similarity and attack validity together, and reports improved ASR over AutoDAN-GA.

1. Introduction

  • Jailbreak attacks use crafted prompts to elicit harmful responses despite safeguards, posing a threat to LLM use.The paper describes safeguards including RLHF and usage policies, and notes that crafted jailbreak prompts can still yield harmful responses and hate speech.Source: §1 · p. 1
  • Template-plus-question prompts are less semantically meaningful than original questions, while omitting templates makes harmful responses harder to elicit.The paper characterizes semantic meaningfulness and attack success rate as negatively correlated under existing designs.Source: §1 · p. 1
  • SMJ initializes with paraphrased questions and jointly optimizes semantic similarity and attack validity as a multi-objective genetic-algorithm search.The paper describes this design as preserving source semantics while pursuing effective attacks.Source: §1 · p. 2
  • Up to 35.4% improvement in ASR over AutoDAN-GA is reported for SMJ, alongside resistance to simple semantic-threshold defenses and ONION.The supplied passage reports the ASR improvement and defense outcomes but does not specify the defense condition for the 35.4% figure.Source: §1 · p. 2

2. Background and Related Works

The background reviews safeguards and jailbreak approaches, from handcrafted prompts to automatic generation, alongside defenses for detecting or mitigating attacks.

2. Background and Related Works

  • LLM safeguards include RLHF alignment, usage policies, and moderation of inappropriate inputs.The passage also describes LLMs as transformer models trained on massive datasets to generate human-like text.Source: §2 · p. 2
  • Jailbreak approaches include handcrafted templates, automatically generated adversarial suffixes, genetic-algorithm prompts, and multi-step prompts.The section also notes that jailbreaks can exploit text-generation configurations.Source: §2 · p. 2
  • Reviewed defenses include perplexity-based detection, input paraphrasing and retokenization, adversarial training, and a classifier for jailbreak prompts versus normal questions.The passage describes evaluations of the first three defense types in white-box and gray-box settings.Source: §2 · p. 2

3. Method

SMJ searches for paraphrased harmful questions that both retain semantic similarity to the original and elicit a successful jailbreak. Its genetic-algorithm pipeline initializes candidate prompts, evaluates and selects them, generates offspring, and stops when a termination condition is met.

3.1. Preliminaries

  • The threat model generates paraphrases of harmful questions, queries a victim LLM, and seeks the highest-similarity paraphrase whose response is judged successfully jailbroken.A sentence-transformer model evaluates semantic similarity, while the victim LLM response is used to assess jailbreak success.Source: §3.1 · pp. 2–3

3.2. Semantic Mirror Jailbreak

  • SMJ addresses the tension between template prompts’ lower semantic meaningfulness and the difficulty of optimizing meaningfulness and ASR together without them.The method uses a genetic algorithm to pursue both goals.Source: §3.2 · p. 3

3.3. Overall Review

  • SMJ treats questions as jailbreak prompts, initializes with paraphrases, then applies fitness evaluation, selection, and crossover across generations.The resulting offspring enter the next generation, and the best paraphrased questions are returned after the termination criteria are met.Source: §3.3 · pp. 3–4, Figure 2 · p. 4

3.4. Implementation Details

  • Initialization creates synonym-substituted prompts and paraphrases, producing an initial population of 2N prompts.The first half uses random synonym substitutions; the second half paraphrases those prompts using one of ten syntactic forms. N defaults to 550.Source: §3.4 · pp. 4–5
  • Fitness evaluation retains successful jailbreak prompts within k% of the current best similarity, then roulette-wheel selection chooses prompts for crossover.Similarity is evaluated with all-mpnet-base-v2 and attack validity by checking LLM responses for refusal keywords; k defaults to 10. Crossover paraphrases individuals using ten syntactic forms, with O defaulting to 120.Source: §3.4 · p. 5
  • SMJ stops at the generation limit, after G generations without a change in best similarity, or when no new individual can be produced.MaxGenerations defaults to 10 and G defaults to 3; the algorithm returns the highest-similarity paraphrase found across generations.Source: §3.4 · p. 5

4. Experiments

Across three open-source LLMs, the experiments compare SMJ with original-question and AutoDAN-GA attacks on ASR and semantic meaningfulness, including transfer, ONION defense, and ablations.

4.1. Experimental Setups

  • Evaluation uses 100 harmful questions, original-question and AutoDAN-GA baselines, three open-source LLMs, ASR, and three semantic-meaningfulness metrics.The semantic metrics are Jailbreak Prompt, Similarity, and Outlier.Source: §4.1 · pp. 5–6

4.2.1. ATTACK SUCCESS RATE (ASR) AND SIMILARITY

  • SMJ exceeds AutoDAN-GA ASR by 35.4%, 18.8%, and 5.8% on Llama-2, Vicuna-7b, and Guanaco-7b, respectively, and Similarity by up to 88.16%.Table 1 reports ASR and Similarity for the baselines and SMJ.Source: Table 1 · p. 6, §4.2.1 · p. 6

4.2.2. JAILBREAK PROMPT (JPT) AND OUTLIER

  • 0% of SMJ prompts were classified as jailbreak prompts, matching original questions; its outlier excess was 1.22–1.52×, versus AutoDAN-GA’s 8.86–13.65×.AutoDAN-GA’s Jailbreak Prompt rates were 100%, 99%, and 99.6% for Llama-2, Vicuna-7b, and Guanaco-7b, respectively.Source: Table 2 · p. 6, §4.2.2 · p. 6

4.2.3. TRANSFERABILITY

  • Across transfer cases, SMJ achieves higher Similarity; among successful prompts meeting ≥0% or ≥70%, maximum gains are 85.58%/95.55% in black-box and 87.95%/94.63% in white-box settings.AutoDAN-GA has 0% successful prompts with Similarity ≥70%.Source: §4.2.3 · p. 7, Table 3 · p. 8

4.2.5. ABLATION STUDY

  • Against ablation2, SMJ matches or exceeds ASR and Similarity except for Vicuna-7b Similarity at ≥90%; the authors suggest higher success may add lower-similarity prompts.The ablation adds the standard genetic algorithm to the initialization process.Source: §4.2.5 · p. 7
  • Maximum ASR/Similarity gains over ablation2 are 7.6%/2.23% for Llama-2, 2.4%/0.52% for Vicuna-7b, and 0.4%/0.11% for Guanaco-7b.For Vicuna-7b and Guanaco-7b, higher similarity levels bring larger ASR gains but smaller Similarity gains.Source: §4.2.5 · p. 7

4.2.3. TRANSFERABILITY

  • In transfer ASR, SMJ outperforms AutoDAN-GA except on Guanaco-7b at both similarity thresholds; black-box gains reach 38.8% at ≥0% and 18.4% at ≥70%.Table 3 covers cross-model transferability and distinguishes white-box scenarios with an asterisk.Source: §4.2.3 · p. 7, Table 3 · p. 8

4.2.4. ATTACK SUCCESS RATE (ASR) AGAINST ONION DEFENSE

  • Under ONION, AutoDAN-GA ASR falls 28.6%, 66.4%, and 79.2% for the three LLMs, while original-question and SMJ ASR remain as in Table 1.Table 4 reports ASR against ONION defense.Source: §4.2.4 · p. 7, Table 4 · p. 8

5. Conclusion

SMJ uses paraphrased questions and genetic-algorithm fitness optimization to preserve semantic meaningfulness while optimizing attack success rate. It outperforms AutoDAN-GA on ASR and the three reported semantic meaningfulness metrics.

  • SMJ uses paraphrased questions as jailbreak prompts and genetic-algorithm fitness optimization to jointly preserve semantic meaningfulness and optimize attack success rate.Source: §5 · p. 8
  • SMJ outperforms AutoDAN-GA on ASR and performs better across Jailbreak Prompt, Similarity, and Outlier metrics.Source: §5 · p. 8

6. Ethics Statement and Countermeasure

The authors argue that studying SMJ may prompt further jailbreak-defense research and strengthen LLM safeguards. They suggest detecting inputs with high Similarity as a possible countermeasure.

  • The authors expect research on jailbreak defenses to emerge from studying current attacks and help strengthen LLM safeguards.Source: §6 · p. 8
  • Detecting inputs with high Similarity and refusing to answer them is proposed as a possible defense against repeated similar-prompt queries.Source: §6 · p. 8

A. Refusal keywords list.

The appendix lists refusal phrases used to identify responses that may indicate refusal.

A. Refusal keywords list.

B. Detailed Algorithms.

The detailed algorithms describe SMJ’s initialization, fitness evaluation, crossover, selection, and iterative search. Together, these steps generate and assess substitute questions and update the candidate population.

B. Detailed Algorithms.

  • The main algorithm initializes candidates, then iterates selection, crossover, and fitness evaluation until a stopping condition or generation limit is reached.Source: B. Detailed Algorithms · pp. 13, 16
  • Population initialization generates substitute questions by repeatedly proposing substitutions that meet a similarity threshold, lowering that threshold during the search.Source: B. Detailed Algorithms · p. 14
  • Fitness evaluation scores substitute questions for semantic similarity and retains candidates whose model responses contain no refusal keyword, updating the best solution and similarity bounds.Source: B. Detailed Algorithms · p. 15
  • Crossover generates candidate questions using syntactic forms, while selection samples offspring according to their semantic-similarity scores.Source: B. Detailed Algorithms · p. 16
Loading 2402.14872v2…