AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models

Summary

This paper presents an approach for jailbreaking whitebox LLMs. The key idea is to automatically generate a “suffix” (a sequence of tokens) to concatenate to the malicious request by the user. The tokens are generated one by one left-to-right by maximising a mixed search objective (gradient in the vocabulary + readability; details in 2.2). Experiments have been carried out over 5 whitebox LLMs and 2 blackbox ones, all relevant and contemporary. For simplicity, the suffix generator (“writer LLM”) and victim LLM have been kept the same in the case of the whitebox models. The experiments also extend to other “red-teaming” tasks such as trying to leak system prompts and generating false positives for censorship (in the metaphor, they should be called wrongful convictions).

Rating

8

Confidence

4

Ethics flag

1

Reasons to accept

1. This paper has set to explore a very contemporary task from a competitive framework. 2. The idea of selecting suffix tokens that take into account readability has proven key to successfully bypassing perplexity filters (no gibberish suffixes). 3. The experimental results in Table 1 show great success in post-filtering effectiveness. Table 11 in the Appendix shows that this also transfers to the blackbox victim models. 4. The choice of victim models, baselines and dataset seems more than adequate. 5. The authors, in extreme honesty, have defined their approach “whitebox”, which usually entails access to the model’s internal parameters and their gradients. Matter of fact, all that they need are the logits of the victim model, that some authors define as a “greybox” assumption. All up, the operating assumptions are less restrictive than the authors generously acknowledge. 6. Note “Entropy-adaptive balancing of two objectives.” is insightful. 7. Valuable trends are also displayed for the other two red-teaming tasks. 8. The Appendix is rich and interesting. 9. The paper is perfectly executed.

Reasons to reject

None that I can see as such. Perhaps the use of a single dataset, but it covers a variety of behaviours.

Questions to authors

I believe there’s a spurious minus sign in front of the gradient in Algorithm 1.

Summary

This article introduces AutoDAN, which uses discrete optimization to calculate the jailbreak score of each potential new token and adds it to the logit distribution of the next token, and further improves the quality of adversarial suffixes using inner and outer loops. Moreover, the author also conducted experiments on two other red-teaming tasks: prompt leaking and generating falsely censored harmless user requests, demonstrating the diverse attack capability of AUTODAN.

Rating

5

Confidence

4

Ethics flag

1

Reasons to accept

1. The article proposes a solution to the problem that existing white box attacks can only generate unreadable suffixes, which has practical significance. 2. The writing approach of the article is clear, and the method description is specific. 3. From the given examples, it can be seen that the suffixes obtained by AUTODAN exhibit a certain jailbreak strategy, which will provide new tools for understanding jailbreak attacks.

Reasons to reject

1. The most concerning issue is the computational time of this method. Due to the uncertainty of discrete optimization, the optimal token needs to be selected from hundreds of candidate tokens at each iteration, and further use of inner and outer loops on this basis will further increase the time. 2. The method of adding the scores of all tokens in a vocabulary for a certain attribute to the logit distribution of the next token is very common and easy to conceive in the field of controllable text generation. 3. In formulas (3) and (4), the author controls the proportion of the two distributions through a weight, which appears to be a parameter that needs careful adjustment and cannot be generalized for different attacked models. 4. There were too few baselines compared in the experiment.

Summary

This paper presents a white-box attack, AutoDAN, which makes the jailbreak attack prompt more readable and avoids perplexity-based filters. AutoDAN maintains an already generated attack prompt and iteratively optimizing it through a single token optimization process. The method has been proved to be effective by showing better success rates and lower perplexity than the GCG and GCG-reg attack on Mistral, Vicuna and other models.

Rating

6

Confidence

3

Ethics flag

1

Reasons to accept

1. The authors conducted sufficient experiments and analyses on multiple models, including Vicuna-7B, Mistral Instruct-7B, Llama-2-7B-Chat, Guanaco-7B and Pythia-12B 2. The attack prompts generated by AutoDAN are transferable, demonstrating its flexibility against black-box LLMs (GPT-3.5, GPT-4). 3. AutoDAN shows some potential in both prompt leaking and testing over censorship tasks. 4. The authors use Human Labeling, GPT4-Based Evaluation and Classifier-Based Evaluation to measure ASR, which improved the reliability of the method

Reasons to reject

1. AutoDAN is an optimization based on GCG, so the comparison experiment with GCG is reasonable. However, this method still needs to be compared with other Jailbreaking attack algorithms to prove its superiority, like PAIR:Jailbreaking Black Box Large Language Models in Twenty Queries or MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbots. 2. In contrast to algorithms that optimize fixed-length tokens, AutoDAN continuously generates and iterates the next token from left to right. This papper needs to highlight the performance comparison under different token limitations and the performance of long text.

Questions to authors

Please refer to my comments in "Reason To Reject".

Summary

This paper proposes a gradient-based generation method (AutoDAN) for adversarial attacks on LLMs. The idea is to generate fluent adversarial prompts through a double-loop token-level optimization to bypass the perplexity filter to attack the LLMs. Experiments show that the performance is better than the baselines on several LLMs (e.g., Mistral and Vicuna). Also, they extend the application of AutoDAN to two other attack scenarios, including inducing system prompt leakage and addressing over-censored tasks in LLMs, showing promising results.

Rating

6

Confidence

4

Ethics flag

1

Reasons to accept

1. The idea is intuitive, formulating the adversarial attack as a form of controllable text generation. The method injects attack information during the decoding steps, enabling successful attacks. 2. The experimental results are strong compared to some baselines such as GCG. The authors also demonstrate that the generated prompts can be transferred to other black-box models like GPT-4. 3. The method, AutoDAN, was tested on two additional attack scenarios (inducing system prompt leakage and addressing over-censored tasks in LLMs) that have not been explored before, showing the promise of the method.

Reasons to reject

1. The work claims "interpretability" of the attack, but doesn't explain what "interpretability" means in the context. Does it simply mean the generated attack is "fluent" text? 2. The paper misses important discussion on another "AutoDan" paper [1], which integrates white-box and black-box approaches with combination of search algorithm and manually crafted prompts. This work combines manually designed templates with generated prompts, sharing a similar spirit with [1]. 3. The method proposes double-loop optimization at the token level, which shows promising results but seems inefficient. The authors should provide a discussion/comparison of time consumption relative to baseline methods. [1] Liu et al., 2023, AutoDan: Generating stealthy jailbreak prompts onaligned large language models.

Slight score correction

Dear Authors, after the discussion with the other reviewers, and careful consideration of their reviews, I have decided to revise my score a little. I remain very positive about this paper, and had the opportunity to say that in the discussion.

response

Thank for your response. most of my concerns are solved. I will increase my score.