about
Defending Against Alignment-Breaking Attacks via Robustly Aligned LLM (arxiv.org)
2 points by PaulHoule on Oct 1, 2023 | hide | past | pdf | 1 comment on HN

In plain words: A safety check added to an already-trained chatbot catches prompts that trick it into ignoring its rules, so no retraining is needed. In tests, it cut the share of attacks that succeeded from nearly 100% to about 10% or less.

Abstract

Recently, Large Language Models (LLMs) have made significant advancements and are now widely used across various domains. Unfortunately, there has been a rising concern that LLMs can be misused to generate harmful or malicious content. Though a line of research has focused on aligning LLMs with human values and preventing them from producing inappropriate content, such alignments are usually vulnerable and can be bypassed by alignment-breaking attacks via adversarially optimized or handcrafted jailbreaking prompts. In this work, we introduce a Robustly Aligned LLM (RA-LLM) to defend against potential alignment-breaking attacks. RA-LLM can be directly constructed upon an existing aligned LLM with a robust alignment checking function, without requiring any expensive retraining or fine-tuning process of the original LLM. Furthermore, we also provide a theoretical analysis for RA-LLM to verify its effectiveness in defending against alignment-breaking attacks. Through real-world experiments on open-source large language models, we demonstrate that RA-LLM can successfully defend against both state-of-the-art adversarial prompts and popular handcrafted jailbreaking prompts by reducing their attack success rates from nearly 100% to around 10% or less.

Bochuan Cao, Yuanpu Cao, Lu Lin, Jinghui Chen
arXiv:2309.14348 · cs.CL, cs.AI, cs.CR, cs.LG · submitted Sep 18, 2023 · updated Jun 12, 2024
abstract · pdf · html · 19 Pages, 5 Figures, 8 Tables. Accepted by ACL 2024

add comment on HN

The main trick here is that the prompts that break alignment are not robust, that is, if you make a lot of perturbations of the input and some of the trigger the “sorry, i can’t help you dave” response and some get an answer you are probably facing an attack.