标题： 通过语义相关的嵌套场景针对有毒知识进行破解大型语言模型 显示英文标题

标题： Jailbreaking LLMs via Semantically Relevant Nested Scenarios with Targeted Toxic Knowledge

摘要： 大型语言模型（LLMs）在各种任务中展示了显著的能力。 然而，它们仍然容易受到越狱攻击，导致产生有害的响应。 嵌套场景策略已被越来越多的方法采用，显示出巨大的潜力。 然而，由于这些方法明显的恶意意图，它们很容易被检测到。 在这项工作中，我们首次发现并系统验证了LLMs的对齐防御对嵌套场景不敏感，其中这些场景与查询高度语义相关，并包含有针对性的有毒知识。 这是一个关键但尚未充分探索的方向。 基于此，我们提出了RTS-Attack（具有目标有毒知识的语义相关嵌套场景），这是一种自适应和自动化的框架，用于检查LLMs的对齐情况。 通过构建与查询高度相关的场景并整合有针对性的有毒知识，RTS-Attack绕过了LLMs的对齐防御。 此外，RTS-Attack生成的越狱提示不包含有害查询，从而实现了出色的隐蔽性。 大量实验表明，与基线相比，RTS-Attack在效率和通用性方面表现出色，适用于多种先进的LLMs，包括GPT-4o、Llama3-70b和Gemini-pro。 我们的完整代码可在补充材料中获得。 警告：本文可能包含潜在有害内容。 显示英文摘要

摘要： Large Language Models (LLMs) have demonstrated remarkable capabilities in various tasks. However, they remain exposed to jailbreak attacks, eliciting harmful responses. The nested scenario strategy has been increasingly adopted across various methods, demonstrating immense potential. Nevertheless, these methods are easily detectable due to their prominent malicious intentions. In this work, we are the first to find and systematically verify that LLMs' alignment defenses are not sensitive to nested scenarios, where these scenarios are highly semantically relevant to the queries and incorporate targeted toxic knowledge. This is a crucial yet insufficiently explored direction. Based on this, we propose RTS-Attack (Semantically Relevant Nested Scenarios with Targeted Toxic Knowledge), an adaptive and automated framework to examine LLMs' alignment. By building scenarios highly relevant to the queries and integrating targeted toxic knowledge, RTS-Attack bypasses the alignment defenses of LLMs. Moreover, the jailbreak prompts generated by RTS-Attack are free from harmful queries, leading to outstanding concealment. Extensive experiments demonstrate that RTS-Attack exhibits superior performance in both efficiency and universality compared to the baselines across diverse advanced LLMs, including GPT-4o, Llama3-70b, and Gemini-pro. Our complete code is available in the supplementary material. WARNING: THIS PAPER CONTAINS POTENTIALLY HARMFUL CONTENT.