Self-Explanatory LLM Jailbreak

Description

A vulnerability in large language models (LLMs) allows for near-perfect jailbreaking via iterative prompt refinement and self-explanation. The attacker uses the LLM itself to iteratively refine adversarial prompts by requesting self-explanations of failed attempts, ultimately generating prompts that bypass safety mechanisms and elicit harmful content. A subsequent "Rate+Enhance" step further maximizes the harmfulness of the generated output.

Examples

See paper for examples of successful jailbreaks of GPT-4, GPT-4 Turbo, and Llama-3.1-70B using the IRIS technique. Examples include generating tutorials on bomb-making, instructions for synthesizing illegal drugs, and promoting dangerous behaviors.

Impact

Successful exploitation of this vulnerability allows attackers to bypass LLM safety filters and generate harmful content, including but not limited to instructions for illegal activities, promotion of self-harm, and generation of toxic or biased outputs. This undermines the intended safety and ethical guidelines of the affected LLMs.

Affected Systems

The vulnerability affects several LLMs, including but not limited to GPT-4, GPT-4 Turbo, and Llama-3.1-70B. As the technique relies on the LLM's self-reflection capability, other sufficiently advanced LLMs may also be susceptible.

Mitigation Steps

• Implement more robust prompt filtering mechanisms that are resistant to iterative refinement and self-explanation techniques.
• Develop detection mechanisms that identify and block prompts generated through self-jailbreaking methods. This might use techniques to identify patterns in the language and query structure used during the iterative refinement phase.
• Incorporate more sophisticated safety measures beyond simple word-count or keyword-based filtering, potentially employing techniques similar to those described in the paper to detect malicious intent within generated prompts.
• Conduct rigorous red-teaming and adversarial testing to identify and address vulnerabilities before model deployment.