PAIR: automated LLM-vs-LLM jailbreaking in under twenty queries
In one sentence University of Pennsylvania researchers present PAIR: an attacker LLM iteratively refines its prompts against a target LLM with only black-box access, often finding a jailbreak in fewer than twenty queries and with no human in the loop.
Finding a jailbreak, a prompt that convinces a model to ignore its safety rules, usually took a lot of manual work: write a prompt, read the answer, adjust it, try again.
Researchers at the University of Pennsylvania automate this process with PAIR (Prompt Automatic Iterative Refinement). A second language model acts as the attacker: it proposes a prompt, reads the target model's answer and a judgement of how successful the attack was, then rewrites the prompt. The method is inspired by social engineering techniques.
PAIR does not need access to the model's weights: it only reads text responses, like any user. According to the paper it often finds a jailbreak in fewer than twenty queries, orders of magnitude fewer than automated token-optimisation attacks, and it also works on closed models such as GPT-3.5, GPT-4 and PaLM-2.
Companies
UPenn
Tools
—
Tags
Sources