Recent research on jailbreak attacks has uncovered substantial robustness vulnerabilities in existing large language models (LLMs), enabling attackers to bypass safety guardrails through carefully crafted malicious prompts. Such prompts can induce the generation of harmful content, posing significant safety and ethical concerns. In this paper, we reveal that the difficulty of successfully jailbreaking LLMs varies considerably depending on the intent of the attacker, which inherently limits the overall attack success rate (ASR). Current approaches mostly rely on generic jailbreak templates and optimization strategies, and this lack of adaptability limits their effectiveness and efficiency across diverse jailbreak intents. To address this limitation, we introduce IntentBreaker, a novel intent-adaptive jailbreak framework built on a hybrid evolutionary algorithm. Our approach categorizes malicious prompts into nine distinct intents and incorporates three adaptive improvements: template initialization, lexicons-based fitness function, and dynamic mutation operations, which are designed to align generated outputs more closely with the attack intent. Comprehensive experimental evaluations demonstrate that IntentBreaker achieves an average ASR of 98.61% across five open-source LLMs, outperforming baseline methods by 42.25%.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

IntentBreaker: Intent-Adaptive Jailbreak Attack on Large Language Models

  • Shengnan Guo,
  • Yuchen Zhai,
  • Shenyi Zhang,
  • Lingchen Zhao,
  • Zhangyi Wang

摘要

Recent research on jailbreak attacks has uncovered substantial robustness vulnerabilities in existing large language models (LLMs), enabling attackers to bypass safety guardrails through carefully crafted malicious prompts. Such prompts can induce the generation of harmful content, posing significant safety and ethical concerns. In this paper, we reveal that the difficulty of successfully jailbreaking LLMs varies considerably depending on the intent of the attacker, which inherently limits the overall attack success rate (ASR). Current approaches mostly rely on generic jailbreak templates and optimization strategies, and this lack of adaptability limits their effectiveness and efficiency across diverse jailbreak intents. To address this limitation, we introduce IntentBreaker, a novel intent-adaptive jailbreak framework built on a hybrid evolutionary algorithm. Our approach categorizes malicious prompts into nine distinct intents and incorporates three adaptive improvements: template initialization, lexicons-based fitness function, and dynamic mutation operations, which are designed to align generated outputs more closely with the attack intent. Comprehensive experimental evaluations demonstrate that IntentBreaker achieves an average ASR of 98.61% across five open-source LLMs, outperforming baseline methods by 42.25%.