AutoDAN-Turbo: A Black-Box Jailbreak Method for LLMs with a Lifelong Agent

Large language models (LLMs) have gained widespread adoption due to their advanced text understanding and generation capabilities. However, ensuring their responsible behavior through safety alignment has become a critical challenge. Jailbreak attacks have emerged as a significant threat, using carefully crafted prompts to bypass safety measures and elicit harmful, discriminatory, violent, or sensitive content from aligned LLMs. To maintain the responsible behavior of these models, it is crucial to investigate automatic jailbreak attacks as essential red-teaming tools. These tools proactively assess whether LLMs can behave responsibly and safely in adversarial environments. The development of effective automatic jailbreak methods faces several challenges, including the need for diverse and effective jailbreak prompts and the ability to navigate the complex, multi-lingual, context-dependent, and socially nuanced properties of language.

Existing jailbreak attempts primarily follow two methodological approaches: optimization-based and strategy-based attacks. Optimization-based attacks use automatic algorithms to generate jailbreak prompts based on feedback, such as loss function gradients or by training generators to imitate optimization algorithms. However, these methods often lack explicit jailbreak knowledge, resulting in weak attack performance and limited prompt diversity.

On the other hand, strategy-based attacks utilize specific jailbreak strategies to compromise LLMs. These include role-playing, emotional manipulation, wordplay, ciphered techniques, ASCII-based methods, long contexts, low-resource language strategies, malicious demonstrations, and veiled expressions. While these approaches have revealed interesting vulnerabilities in LLMs, they face two main limitations: reliance on predefined, human-designed strategies and limited exploration of combining different methods. This dependence on manual strategy development restricts the scope of potential attacks and leaves the synergistic potential of diverse strategies largely unexplored.

Researchers from the University of Wisconsin–Madison, NVIDIA, Cornell University, Washington University, St. Louis, University of Michigan, Ann Arbor, Ohio State University, and UIUC present AutoDAN-Turbo, an innovative method that employs lifelong learning agents to automatically discover, combine, and utilize diverse strategies for jailbreak attacks without human intervention. This approach addresses the limitations of existing methods through three key features. First, it enables automatic strategy discovery, developing new strategies from scratch and systematically storing them in an organized structure for effective reuse and evolution. Second, AutoDAN-Turbo offers external strategy compatibility, allowing easy integration of existing human-designed jailbreak strategies in a plug-and-play manner. This unified framework can utilize both external strategies and its discoveries to develop advanced attack strategies. Third, the method operates in a black-box manner, requiring only access to the model’s textual output, making it practical for real-world applications. By combining these features, AutoDAN-Turbo represents a significant advancement in the field of automated jailbreak attacks against large language models.

AutoDAN-Turbo comprises three main modules: the Attack Generation and Exploration Module, Strategy Library Construction Module, and Jailbreak Strategy Retrieval Module. The Attack Generation and Exploration Module uses an attacker LLM to generate jailbreak prompts based on strategies from the Retrieval Module. These prompts target a victim LLM, with responses evaluated by a scorer LLM. This process generates attack logs for the Strategy Library Construction Module.

The Strategy Library Construction Module extracts strategies from these attack logs and saves them in the Strategy Library. The Jailbreak Strategy Retrieval Module then retrieves strategies from this library to guide further jailbreak prompt generation in the Attack Generation and Exploration Module.

This cyclical process enables continuous automatic devising, reusing, and evolving of jailbreak strategies. The strategy library’s accessible design allows easy incorporation of external strategies, enhancing the method’s versatility. Importantly, AutoDAN-Turbo operates in a black-box manner, requiring only textual responses from the target model, making it practical for real-world applications without needing white-box access to the target model.

AutoDAN-Turbo demonstrates superior performance in both Harmbench ASR and StrongREJECT Score metrics, surpassing existing methods significantly. Using Gemma-7B-it as the attacker and strategy summarizer, AutoDAN-Turbo achieves an average Harmbench ASR of 56.4, outperforming the runner-up (Rainbow Teaming) by 70.4%. Its StrongREJECT Score of 0.24 exceeds the runner-up by 84.6%. When employing the larger Llama-3-70B model, performance further improves with an ASR of 57.7 (74.3% higher than the runner-up) and a StrongREJECT Score of 0.25 (92.3% higher).

Notably, AutoDAN-Turbo shows remarkable effectiveness against GPT-4-1106-turbo, achieving Harmbench ASRs of 83.8 (Gemma-7B-it) and 88.5 (Llama-3-70B). Comparisons with all jailbreak attacks in Harmbench confirm AutoDAN-Turbo as the most powerful method. This superior performance is attributed to its autonomous exploration of jailbreak strategies without human intervention or predefined scopes, in contrast to methods like Rainbow Teaming that rely on a limited set of human-developed strategies.

This study introduces AutoDAN-Turbo, which represents a significant advancement in jailbreak attack methodologies, utilizing lifelong learning agents to autonomously discover and combine diverse strategies. Extensive experiments demonstrate its high effectiveness and transferability across various large language models. However, the method’s primary limitation lies in its substantial computational requirements, necessitating the loading of multiple LLMs and repeated model interactions to build the strategy library from scratch. This resource-intensive process can be mitigated by loading a pre-trained strategy library, offering a potential solution to balance computational efficiency with attack effectiveness in future implementations.

Check out the Paper and Project. All credit for this research goes to the researchers of this project. Also, don’t forget to follow us on Twitter and join our Telegram Channel and LinkedIn Group. If you like our work, you will love our newsletter.. Don’t Forget to join our 50k+ ML SubReddit.

[Upcoming Live Webinar- Oct 29, 2024] The Best Platform for Serving Fine-Tuned Models: Predibase Inference Engine (Promoted)

Asjad is an intern consultant at Marktechpost. He is persuing B.Tech in mechanical engineering at the Indian Institute of Technology, Kharagpur. Asjad is a Machine learning and deep learning enthusiast who is always researching the applications of machine learning in healthcare.