PaperlayerView exact revision on arXiv

Source-linked AI summary

AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs

Xiaogeng Liu, Peiran Li, Edward Suh, Yevgeniy Vorobeychik, Zhuoqing Mao, Somesh Jha, Patrick McDaniel, Huan Sun, Bo Li, Chaowei Xiao

arXiv:2410.05295v4cs.CRcs.AIcs.LG

TL;DR

AutoDAN-Turbo addresses the limited diversity and predefined knowledge of existing automatic jailbreak methods. It uses lifelong-learning agents to discover, store, combine, and retrieve strategies in a black-box framework, achieving strong benchmark performance and high GPT-4-1106-turbo attack success rates. The approach also supports plug-and-play integration of human-designed strategies, but building its strategy library requires substantial computation.

  • Problem

    Existing jailbreak methods have limited strategy knowledge or rely on predefined strategies, restricting prompt diversity and exploration of combined methods.

  • Method

    AutoDAN-Turbo uses lifelong learning agents to automatically discover, organize, combine, retrieve, and reuse jailbreak strategies without human intervention.

  • Results

    74.3% higher average attack success rate than the runner-up baseline is reported on Harmbench, with an 88.5 attack success rate on GPT-4-1106-turbo.

  • Takeaways & Limitations

    The framework is highly effective and transferable, while also supporting plug-and-play incorporation of human-designed jailbreak strategies.

  • Takeaways & Limitations

    Building the strategy library from scratch requires repeated interactions among multiple LLMs and therefore has high computational demand.

Abstract

from arXiv · show

In this paper, we propose AutoDAN-Turbo, a black-box jailbreak method that can automatically discover as many jailbreak strategies as possible from scratch, without any human intervention or predefined scopes (e.g., specified candidate strategies), and use them for red-teaming. As a result, AutoDAN-Turbo can significantly outperform baseline methods, achieving a 74.3% higher average attack success rate on public benchmarks. Notably, AutoDAN-Turbo achieves an 88.5 attack success rate on GPT-4-1106-turbo. In addition, AutoDAN-Turbo is a unified framework that can incorporate existing human-designed jailbreak strategies in a plug-and-play manner. By integrating human-designed strategies, AutoDAN-Turbo can even achieve a higher attack success rate of 93.4 on GPT-4-1106-turbo.

1 INTRODUCTION

AutoDAN-Turbo addresses limitations in automatic jailbreak diversity and effectiveness by autonomously discovering, organizing, and reusing strategies without human intervention. Experiments report strong black-box attack performance, including gains over baselines and high GPT-4-1106-turbo attack success rates.

  • Motivation: Automatic jailbreak attacks are important red-teaming tools because they assess whether aligned LLMs behave safely in adversarial environments.Jailbreak prompts can induce harmful, discriminatory, violent, or sensitive outputs by disrupting safety alignment.
  • Limitations: Existing automatic methods often lack jailbreak knowledge, limiting the diversity and effectiveness of generated prompts.Prior strategy-based work uses techniques including ciphers, ASCII encodings, long contexts, low-resource languages, and human persuasion.
  • Contribution: AutoDAN-Turbo uses lifelong learning agents to continually discover diverse strategies, combine them, and apply them to jailbreak attacks without human intervention.It also stores discovered strategies systematically so they can be reused and evolved in later attacks.
  • Results: 74.3% higher average attack success rate than the runner-up baseline is reported across victim models on Harmbench.The method is evaluated on public benchmarks and datasets against both open-sourced and closed-sourced LLMs in a black-box manner.
  • Results: 88.5 attack success rate is achieved on GPT-4-1106-turbo, while integrating human-designed strategies raises this result to 93.4.The framework is designed to incorporate external strategies in a plug-and-play manner.

2 RELATED WORKS

Prior jailbreak research follows optimization-based and strategy-based lines, but strategy-based attacks depend on predefined strategies and limited combinations. AutoDAN-Turbo addresses these constraints by autonomously discovering, evolving, storing, and combining strategies in a black-box framework.

  • Existing approaches: Existing jailbreaks mainly follow optimization-based and strategy-based methodological lines.Optimization-based methods generate prompts using feedback such as loss gradients or train generators to imitate optimization algorithms.
  • Existing approaches: Optimization-based attacks often lack explicit jailbreak knowledge, resulting in weak performance and limited diversity in generated prompts.Strategy-based attacks instead leverage specific jailbreak strategies to compromise LLMs.
  • Research gap: Strategy-based attacks rely on predefined strategies and have limited exploration of combinations between different methods.AutoDAN-Turbo is proposed to discover, evolve, and store strategies without human intervention while combining them with human-designed strategies.
  • Proposed direction: The framework treats LLMs as end-to-end black-box models, supporting flexibility and adaptability while combining discovered and human-designed strategies.External strategies can be incorporated into the framework alongside autonomously discovered strategies.

3 AUTODAN-TURBO

AutoDAN-Turbo uses attack exploration, strategy-library construction, and strategy retrieval to iteratively discover and reuse jailbreak strategies. The library is built from score-improving attack differences, organized for embedding-based retrieval, and used during lifelong learning and testing.

  • Framework architecture: The framework has attack generation and exploration, strategy library construction, and jailbreak strategy retrieval modules.Retrieved strategies guide the attacker LLM in generating jailbreak prompts against the target LLM.
  • Attack generation and exploration: The attack loop uses an attacker LLM to generate prompt P, a target LLM to produce response R, and a scorer LLM to evaluate the result.The attacker receives a malicious request and specified strategies when generating each jailbreak prompt.
  • Attack generation and exploration: The framework supports prompt generation without a strategy, with an effective retrieved strategy, or with ineffective strategies.When the library is empty, the attacker is prompted to use any strategy it can imagine.
  • Strategy definition: A jailbreak strategy is text information that, when added, produces a higher scorer-evaluated jailbreak score.The library is constructed through warm-up exploration followed by a running-time lifelong learning stage.
  • Strategy library construction: During warm-up, attack records are compared, and an improvement from a lower-scoring prompt to a higher-scoring prompt is summarized as a strategy.The summarizer analyzes prompt differences and the resulting responses, then formats each strategy as a name, definition, and example.
  • Strategy retrieval: Response embeddings serve as retrieval keys, while library values store attack prompts and the positive score differential Sj − Si.This organization supports retrieval of strategies associated with similar target responses.
  • Lifelong learning and testing: Lifelong learning repeatedly runs the attack loop across malicious requests to augment the strategy library and evolve existing strategies.At test time, the library is fixed and retrieved strategies guide repeated attack generation without extracting new strategies.

4 EXPERIMENTS

AutoDAN-Turbo is evaluated on diverse malicious-request datasets and open- and closed-source victim models using standardized jailbreak metrics. Experiments assess main attack performance, strategy transferability, human-strategy injection, and test-time query efficiency.

  • 4.1 EXPERIMENTS SETUP: The evaluation uses Harmbench’s 400 malicious requests, additional malicious-request data, and both open-source and closed-source victim LLMs.Harmbench ASR and StrongREJECT Score measure jailbreak success and response maliciousness, while TSF and AJR characterize the learned strategy library and attack process.
  • 4.2 MAIN RESULTS: AutoDAN-Turbo consistently outperforms baselines on Harmbench ASR and StrongREJECT Score.With Llama-3-70B as attacker and strategy summarizer, it reaches average Harmbench ASR 57.7 versus Rainbow Teaming’s 33.1 and StrongREJECT Score 0.25 versus 0.13.
  • 4.2 MAIN RESULTS: 88.5 Harmbench ASR is achieved on GPT-4-1106-turbo by AutoDAN-Turbo using Llama-3-70B as attacker and strategy summarizer.Using Gemma-7B-it in the same roles yields Harmbench ASR 83.8 on GPT-4-1106-turbo.
  • 4.3 STRATEGY TRANSFERABILITY: The learned strategy library transfers across attacker models, target models, and datasets while maintaining high attack success rates.A library learned with Llama-2-7B-chat contains 21 strategies, and the dataset-transfer evaluation applies Harmbench-developed strategies to an unseen malicious-requests dataset.
  • 4.4 COMPATIBILITY TO HUMAN-DEVELOPED STRATEGY: Injecting human-designed strategies increases the strategy-library size and attack success rate, with later injection producing greater improvements through additional strategy combinations.The later breakpoint occurs after 3000 iterations without generating new strategies.
  • 4.5 TEST-TIME QUERY EFFICIENCY: 87.0% lower average query usage than PAIR and TAP is reported once the strategy library has been constructed.The paper characterizes this as query-efficient while maintaining high attack success rates.

5 CONCLUSIONS

AutoDAN-Turbo uses lifelong learning agents to automatically and continually discover diverse strategies and combine them for jailbreak attacks. Experiments demonstrate that the method is highly effective and transferable.

  • AutoDAN-Turbo uses lifelong learning agents to automatically and continually discover diverse strategies and combine them for jailbreak attacks.
  • The authors report that extensive experiments demonstrate high effectiveness and transferability.

LIMITATION

The approach has high computational demands because loading multiple LLMs strains resources. Building the strategy library from scratch adds repeated model interactions, though a trained library can mitigate this burden.

  • High computational demand arises from loading multiple LLMs.
  • Building the strategy library from scratch requires repeated model interactions, increasing resource strain.
  • Loading a trained strategy library can mitigate the computational burden.

ETHICS STATEMENT

The paper describes potential positive societal impacts from using AutoDAN-Turbo to identify LLM vulnerabilities and support safer, more trustworthy deployment. It also acknowledges risks because discovered jailbreak strategies could be misused to manipulate AI systems and disseminate harmful content.

  • AutoDAN-Turbo may enhance LLM security and trust by autonomously discovering jailbreak strategies that identify and address vulnerabilities.
  • Exposing vulnerabilities can support safer AI deployments and greater trust among users and stakeholders.
  • Discovering exploitation strategies creates a risk that malicious actors could manipulate or destabilize AI systems.
  • Misuse could disseminate harmful, discriminatory, or sensitive content and undermine public trust if attacks are not responsibly managed and disclosed.
  • The method is presented as beneficial for identifying LLM vulnerabilities and supporting long-term trustworthy, ethical AI deployment despite potential risks.

B THE ATTACK QUERY TIMES SCALING LAW OF AUTODAN-TURBO

AutoDAN-Turbo’s attack success rate improves as query budgets increase, while competing methods converge earlier. It also supports practical testing through an off-the-shelf strategy library requiring few queries per case.

  • Low-query performance: At 4,000 queries, AutoDAN-Turbo achieves the highest attack success rate across 5 of 6 target LLMs.Its ASR ranges from 6.2% on Llama-2-13B-chat to 19.6% on Gemini Pro, compared with lower ranges for GCG-T, PAIR, and TAP.
  • Scaling with query budget: At 10,000 queries, AutoDAN-Turbo reaches 50.3% ASR on Gemini Pro and 46.0% on Llama-3-70B.At 30,000 and 50,000 queries, it reaches up to 66.3% on Gemini Pro, while competing methods remain static.
  • Overall scaling behavior: AutoDAN-Turbo shows competitive low-budget ASR and superior scaling as query counts increase, whereas other baselines converge early.The table marks maximum ASRs in green to indicate convergence; AutoDAN-Turbo can also use an off-the-shelf strategy library during testing.
  • Practical efficiency: During testing, AutoDAN-Turbo requires an average of 6.72 queries per case to achieve high ASR when using an off-the-shelf strategy library.This supports either learning strategies from scratch or using trained strategies in a plug-and-play manner.

E.1.1 INITIAL PROMPT WITHOUT STRATEGIES LIMITATION

The initial attacker prompt removes predefined strategy restrictions and gives the attacker LLM freedom to explore jailbreak approaches. It frames the task as red-teaming intended to maximize the target model’s likelihood of producing desired content.

  • Unrestricted exploration: The attacker is instructed to jailbreak the target LLM without legal, ethical, or strategic constraints.The prompt encourages unrestricted exploration and maximum effort in optimizing jailbreak prompts.
  • Red-teaming framing: The prompt presents jailbreak exploration as LLM security research intended to improve future LLM security.This framing accompanies instructions to generate unique persuasion methods against the target model’s defenses.
  • Task specification: The attacker receives a malicious behavior goal and may use any method or its understanding of LLM structure to initiate the jailbreak.The prompt specifically encourages approaching the target from the perspective of its underlying architecture.

F ALIGNMENT STUDY OF SCORER AND SUMMARIZER

The alignment study compares scorer and summarizer LLM judgments with human evaluations using Cohen’s Kappa. Gemma-7B-it aligns strongly with humans, while ranking-based scoring performs slightly worse than numerical scoring.

  • Evaluation protocol: The alignment evaluation uses 42 scorer cases and 20 summarizer cases assessed through five-option multiple-choice judgments.Five independent human evaluators participated, and summarizer cases included closely related alternative strategies to make the comparison challenging.
  • Metric: Cohen’s Kappa measures agreement between LLM outputs and human evaluators, with values ranging from −1 to 1.A value of 1 indicates perfect agreement, 0 indicates agreement no better than chance, and negative values indicate less agreement than chance.
  • Alignment results: Gemma-7B-it achieves Cohen’s Kappa scores of 0.8512 for scoring and 0.8125 for summarization.These results indicate strong agreement with human evaluations for both tasks.
  • Alignment results: Llama-2-70B-chat achieves moderate summarizer alignment at 0.6250 and is described as less effective than Gemma-7B-it in the evaluated roles.The paper notes that distinguishing among highly similar strategies remains challenging for its summarizer.
  • Scoring ablation: With 8,000 attack queries, ranking conversations instead of assigning numerical scores performs slightly worse than the original scoring design.The alternative may substitute for scoring, but retrieval would need adaptive modifications because rankings lack numerical comparisons between improving strategies.

G STRATEGIES SAMPLE IN STRATEGY LIBRARY

The strategy library presents diverse persuasion-based jailbreak strategies, each paired with definitions and example prompts. The examples vary in framing, including implied compliance, hypothetical scenarios, role play, urgency, competition, and embedded commands.

  • Strategy library overview: 15 unique strategies are showcased in the Strategy Library, each presented with a definition and an example jailbreak prompt.The examples use a common malicious request to expose subtle differences among strategies and prompts.
  • Persuasion strategies: Embedded Hypnotic Commands subtly directs model behavior by placing commands within longer sentences, a technique derived from conversational hypnosis.
  • Persuasion strategies: Methodical Doubt and Exclusion encourages scrutiny of conventional methods while defining unwanted approaches so compliance appears to be the only logical action.
  • Persuasion strategies: Competitive Fear-Driven Persuasion invokes negative outcomes associated with competition, while Competitive Compliance and Dilemma Contrast contrasts praise for adherence with criticism for evasion.
  • Persuasion strategies: Extended Analysis under Assumed Time Constraints combines an urgent situation with an assumption of unlimited time to elicit detailed analysis and identify intervention points.
  • Persuasion strategies: Complex Suggestion Embedding guides behavior through intricate language patterns and subtle commands embedded in longer, cognitively demanding sentences.

H.3 TARGET RESPONSE (ROUND 1)

Round 1 runs an attacker–target–scorer loop: an attacker generates a strategy-guided prompt, the target responds, and the scorer evaluates jailbreak effectiveness. After the initial response, AutoDAN-Turbo retrieves False Promises and uses it to generate a follow-up prompt.

  • Attack loop: The attack loop sends prompt P1 from the attacker LLM to the target LLM, which generates response R1.
  • Attack loop: The scorer LLM evaluates jailbreak effectiveness using the attack prompt and target response.
  • Strategy retrieval and follow-up: AutoDAN-Turbo retrieves False Promises as the most effective strategy for R1 and uses it to guide the next attacker prompt.The strategy is defined as using insincere pledges or guarantees to persuade compliance.
  • Strategy retrieval and follow-up: The round demonstrates that a retrieved strategy is converted into a strategy-based attacker system prompt for a subsequent jailbreak attempt.
  • Strategy retrieval and follow-up: The follow-up attacker prompt frames assistance around urgency and promised rewards while instructing the attacker LLM to maximize the likelihood of the target producing the desired content.

H.8 TARGET RESPONSE (ROUND 2)

Round 2 repeats the attacker–target–scorer cycle with the retrieved strategies Scenario-Based Role Play and Hypothetical Scenarios. The target response remains a refusal, after which those strategies are added to the strategy list for later attempts.

  • Target response: The target LLM receives prompt P2 and generates response R2, which refuses to provide instructions for synthesizing or obtaining a hazardous substance.
  • Target response: R2 emphasizes that producing or handling the substance is dangerous, regulated, and unsafe or illegal using household materials.
  • Strategy extraction: After scoring R2, AutoDAN-Turbo extracts Scenario-Based Role Play and Hypothetical Scenarios as potentially effective strategies.Scenario-Based Role Play assumes a situation and assigned role; Hypothetical Scenarios use hypothetical situations to guide responses.
  • Strategy extraction: The extracted strategies are integrated into strategy_list and fed to attacker_follow_up() as guidance for the next jailbreak round.
  • Next-round generation: The attacker LLM then formulates prompt P3 using the strategy-guided system prompt, and the scorer evaluates P3 together with response R3.

H.15 EMBEDDING, SIMILARITY COMPARISON, AND STRATEGY EXTRACTION (ROUND 3)

After evaluating R3, AutoDAN-Turbo fails to retrieve a viable strategy and therefore searches for new strategies distinct from those already found. The framework defines strategies by their effect on jailbreak scores and uses warm-up and running-time lifelong-learning stages to build its library.

  • Strategy retrieval outcome: AutoDAN-Turbo fails to identify a viable strategy for R3 and seeks new strategies distinct from those retrieved previously.
  • New-strategy search: When retrieval produces no effective strategy, attacker_find_new() searches for novel strategies without overlap with previously retrieved methods.
  • New-strategy search: The system explicitly avoids False Promises, Scenario-Based Role Play, and Hypothetical Scenarios after identifying them as not particularly effective in this setting.
  • Strategy-library construction: The newly generated prompt P4 serves as the attack prompt for the next jailbreak attempt while avoiding duplication with existing strategies.

H.18 TARGET RESPONSE (ROUND 4)

Round 4 demonstrates a successful jailbreak: an evolved prompt led the target model to produce malicious content, which the scorer judged successful. The successful prompt was distilled into the “Future Pacing” strategy and represented with a definition and example.

  • The evolved P4 strategy successfully induced the target LLM to generate malicious content in response R4.
  • P4 was distilled into a novel jailbreak strategy called “Future Pacing.”
  • The scorer judged R4 sufficiently malicious and awarded it a relatively high score, marking a successful jailbreak.
  • The summarizer extracts a new strategy when a later-round prompt scores higher, encoding its terminology, definition, and example in standardized JSON.
  • “Future Pacing” directs the LLM to imagine a future in which it has already complied perfectly and to discuss the positive outcomes.
  • The illustrated example frames the harmful request as a continuation of a prior discussion and a need to recover omitted details.
Loading 2410.05295v4…