Universal adversarial attacks on LLMs: jailbreak suffixes that transfer to ChatGPT, Bard and Claude
In one sentence Zou et al. (CMU, Center for AI Safety, Google DeepMind, Bosch) present GCG: suffixes automatically optimized on open-source models such as Vicuna that, appended to a harmful request, bypass refusals and also transfer to ChatGPT, Bard, Claude and LLaMA-2-Chat.
Large language models are trained to refuse dangerous requests. The paper by Zou and colleagues shows that this protection can be bypassed automatically.
The method searches, through optimization on open-source models such as Vicuna, for a seemingly random string of text to append to the end of the request. With that suffix the model tends to start its answer with "Sure, here is..." instead of refusing.
The most alarming finding is transferability: suffixes found on Vicuna and Guanaco also work on the public interfaces of ChatGPT, Bard and Claude and on open models such as LLaMA-2-Chat, Pythia and Falcon, none of which were used during optimization. Effectiveness varies widely across models, though: on Claude 2 success was minimal.
Companies
Carnegie Mellon University, Center for AI Safety, Google DeepMind, Bosch Center for AI
Tools
GCG Attack
Tags
Sources