Improved Generation of Adversarial Examples Against Safety-aligned LLMs

TL;DR

This paper appropriate the ideologies of effective methods among these transfer-based attacks, i.e., Skip Gradient Method and Intermediate Level Attack, into gradient-based adversarial prompt generation and achieve significant performance gains without introducing obvious computational cost.

Abstract

Adversarial prompts generated using gradient-based methods exhibit outstanding performance in performing automatic jailbreak attacks against safety-aligned LLMs. Nevertheless, due to the discrete nature of texts, the input gradient of LLMs struggles to precisely reflect the magnitude of loss change that results from token replacements in the prompt, leading to limited attack success rates against safety-aligned LLMs, even in the white-box setting. In this paper, we explore a new perspective on this problem, suggesting that it can be alleviated by leveraging innovations inspired in transfer-based attacks that were originally proposed for attacking black-box image classification models. For the first time, we appropriate the ideologies of effective methods among these transfer-based attacks, i.e., Skip Gradient Method and Intermediate Level Attack, into gradient-based adversarial prompt generation and achieve significant performance gains without introducing obvious computational cost. Meanwhile, by discussing mechanisms behind the gains, new insights are drawn, and proper combinations of these methods are also developed. Our empirical results show that 87% of the query-specific adversarial suffixes generated by the developed combination can induce Llama-2-7B-Chat to produce the output that exactly matches the target string on AdvBench. This match rate is 33% higher than that of a very strong baseline known as GCG, demonstrating advanced discrete optimization for adversarial prompt generation against LLMs. In addition, without introducing obvious cost, the combination achieves >30% absolute increase in attack success rates compared with GCG when generating both query-specific (38% -> 68%) and universal adversarial prompts (26.68% -> 60.32%) for attacking the Llama-2-7B-Chat model on AdvBench. Code at: https://github.com/qizhangli/Gradient-based-Jailbreak-Attacks.

Figures (8)

• Figure 1: An example of the residual block.
• Figure 2: How (a) the loss and (b) the match rate changes with attack iterations. The attacks are performed against Llama-2-7B-Chat model to generate query-specific adversarial suffixes on AdvBench. Best viewed in color.
• Figure 3: The cosine similarities between the gradients from residual modules and the gradients from skip connections in different residual blocks.
• Figure 4: Comparing the average effects of residual modules and the average effects of skip connections on the change in adversarial loss varies with different residual blocks. Best viewed in color.
• Figure 5: (a) The PCCs computed on the entire intermediate representations, i.e., $\mathrm{PCC} (h^T_r \nabla_{h_r}L(x), L(x))$ and $\mathrm{PCC} (h^T_r v_r, L(x))$, at different layers of Llama-2-7B-Chat. (b) The PCCs computed on the $o$-th token intermediate representations, i.e., $\mathrm{PCC} (h_{r,o}\nabla_{h_{r,o}}L(x), L(x))$ and $\mathrm{PCC} (h^T_{r,o} v_{r,o}, L(x))$, at the mid-layer of Llama-2-7B-Chat. Best viewed in color.