Jailbreaking Large Language Models Against Moderation Guardrails via Cipher Characters

2024/05/30 by Haibo Jin, Jin, Haibo, Andy Zhou +5 · 9 citations
Computer Science · #Adversarial Robustness in Machine Learning #Computation and Language (cs.CL) #Computer Vision and Pattern Recognition (cs.CV) #Cryptographic Implementations and Security #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Hate Speech and Cyberbullying Detection #Machine Learning (cs.LG)

paper · pdf · doi:10.48550/arxiv.2405.20413

openalex publication_date 2024/05/30 · openalex created_date 2024/06/04 · openalex updated_date 2026/07/28

Abstract

Large Language Models (LLMs) are typically harmless but remain vulnerable to carefully crafted prompts known as ``jailbreaks'', which can bypass protective measures and induce harmful behavior. Recent advancements in LLMs have incorporated moderation guardrails that can filter outputs, which trigger processing errors for certain malicious questions. Existing red-teaming benchmarks often neglect to include questions that trigger moderation guardrails, making it difficult to evaluate jailbreak effectiveness. To address this issue, we introduce JAMBench, a harmful behavior benchmark designed to trigger and evaluate moderation guardrails. JAMBench involves 160 manually crafted instructions covering four major risk categories at multiple severity levels. Furthermore, we propose a jailbreak method, JAM (Jailbreak Against Moderation), designed to attack moderation guardrails using jailbreak prefixes to bypass input-level filters and a fine-tuned shadow model functionally equivalent to the guardrail model to generate cipher characters to bypass output-level filters. Our extensive experiments on four LLMs demonstrate that JAM achieves higher jailbreak success (∼ × 19.88) and lower filtered-out rates (∼ × 1/6) than baselines.

Cited by

• Distillability of LLM Security Logic: Predicting Attack Success Rate of Outline Filling Attack via Ranking Regression
• An Automated Framework for Strategy Discovery, Retrieval, and Evolution in LLM Jailbreak Attacks
• Adjacent Words, Divergent Intents: Jailbreaking Large Language Models via Task Concurrency
• PLAGUE: Plug-and-play framework for Lifelong Adaptive Generation of Multi-turn Exploits
• MetaBreak: Jailbreaking Online LLM Services via Special Token Manipulation
• Obscure but Effective: Classical Chinese Jailbreak Prompt Optimization via Bio-Inspired Search
• All Code, No Thought: Current Language Models Struggle to Reason in Ciphered Language
• MEUV: Achieving Fine-Grained Capability Activation in Large Language Models via Mutually Exclusive Unlock Vectors
• SafeLLM: Unlearning Harmful Outputs from Large Language Models against Jailbreak Attacks

Related

• Multi-round jailbreak attack on large language models
• Behind the Mask: Benchmarking Camouflaged Jailbreaks in Large Language Models
• MoJE: Mixture of Jailbreak Experts, Naive Tabular Classifiers as Guard for Prompt Attacks
• Guarding the Guardrails: A Taxonomy-Driven Approach to Jailbreak Detection
• Distract Large Language Models for Automatic Jailbreak Attack