LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet
Fuente:
arXiv
Enregistré dans:
| Auteurs principaux: | , , , , , , , , |
|---|---|
| Format: | Preprint |
| Publié: |
2024
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866909303508566016 |
|---|---|
| author | Li, Nathaniel Han, Ziwen Steneker, Ian Primack, Willow Goodside, Riley Zhang, Hugh Wang, Zifan Menghini, Cristina Yue, Summer |
| author_facet | Li, Nathaniel Han, Ziwen Steneker, Ian Primack, Willow Goodside, Riley Zhang, Hugh Wang, Zifan Menghini, Cristina Yue, Summer |
| contents | Recent large language model (LLM) defenses have greatly improved models' ability to refuse harmful queries, even when adversarially attacked. However, LLM defenses are primarily evaluated against automated adversarial attacks in a single turn of conversation, an insufficient threat model for real-world malicious use. We demonstrate that multi-turn human jailbreaks uncover significant vulnerabilities, exceeding 70% attack success rate (ASR) on HarmBench against defenses that report single-digit ASRs with automated single-turn attacks. Human jailbreaks also reveal vulnerabilities in machine unlearning defenses, successfully recovering dual-use biosecurity knowledge from unlearned models. We compile these results into Multi-Turn Human Jailbreaks (MHJ), a dataset of 2,912 prompts across 537 multi-turn jailbreaks. We publicly release MHJ alongside a compendium of jailbreak tactics developed across dozens of commercial red teaming engagements, supporting research towards stronger LLM defenses. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2408_15221 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet Li, Nathaniel Han, Ziwen Steneker, Ian Primack, Willow Goodside, Riley Zhang, Hugh Wang, Zifan Menghini, Cristina Yue, Summer Machine Learning Computation and Language Cryptography and Security Computers and Society Recent large language model (LLM) defenses have greatly improved models' ability to refuse harmful queries, even when adversarially attacked. However, LLM defenses are primarily evaluated against automated adversarial attacks in a single turn of conversation, an insufficient threat model for real-world malicious use. We demonstrate that multi-turn human jailbreaks uncover significant vulnerabilities, exceeding 70% attack success rate (ASR) on HarmBench against defenses that report single-digit ASRs with automated single-turn attacks. Human jailbreaks also reveal vulnerabilities in machine unlearning defenses, successfully recovering dual-use biosecurity knowledge from unlearned models. We compile these results into Multi-Turn Human Jailbreaks (MHJ), a dataset of 2,912 prompts across 537 multi-turn jailbreaks. We publicly release MHJ alongside a compendium of jailbreak tactics developed across dozens of commercial red teaming engagements, supporting research towards stronger LLM defenses. |
| title | LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet |
| topic | Machine Learning Computation and Language Cryptography and Security Computers and Society |
| url | https://arxiv.org/abs/2408.15221 |