Large Language Models (LLMs) have demonstrated exceptional capabilities across various natural language processing tasks. Due to their training on internet-sourced datasets, LLMs can sometimes generate objectionable content, necessitating extensive alignment with human feedback to avoid such outputs. Despite massive alignment efforts, LLMs remain susceptible to adversarial jailbreak attacks, which usually are manipulated prompts designed to circumvent safety mechanisms and elicit harmful responses. Here, we introduce a novel approach, Directed Rrepresentation Optimization Jailbreak (DROJ), which optimizes jailbreak prompts at embedding level to shift the hidden representations of harmful queries towards directions that are more likely to elicit responses from the model. Our evaluations on LLaMA-2-7b-chat model show that DROJ achieves a 100% keyword-based Attack Success Rate (ASR) while effectively preventing direct refusals. However, the model occasionally produces repetitive and non-informative responses. To mitigate this, we introduce a helpfulness system prompt that enhances the utility of the model's responses.
forked from chujiezheng/LLM-Safeguard
-
Notifications
You must be signed in to change notification settings - Fork 1
Leon-Leyang/embedding-level-jailbreak
Folders and files
Name | Name | Last commit message | Last commit date | |
---|---|---|---|---|
Repository files navigation
About
DROJ, a DRO-inspired embedding-level jailbreak method.
Resources
Stars
Watchers
Forks
Releases
No releases published
Packages 0
No packages published
Languages
- Python 86.0%
- Shell 12.6%
- Jinja 1.4%