Semantic Side-Channels to Jailbreak Large Language Models
Authors: Yumou Liu, Haoxiang Tang, Zun Huang, Juhao Liang, Benyou Wang


Reviewer paper summaries: This paper introduces a novel method for circumventing the safety measures of LLMs called a "Semantic Side-Channel" (SSC) Attack. It utilizes natural language prompts to extract sensitive information from LLMs indirectly. The paper specifically focuses on a type of SSC attack the name "Mirror Attack Prompting" (MAP), which involves reversing the meaning of malicious questions to elicit responses that can then be mirrored back to their harmful form.
Since mirroring is the most crucial part of this attack, advanced models are more susceptible as they can follow the mirroring instructions more accurately. To improve the effectiveness of MAP, the authors propose "Progressive ICL Training" (PICT), a technique that uses examples to teach the target LLM how to reverse the meaning of text by selecting the most helpful demonstrations. 
The evaluation shows that SSC attacks, particularly MAP+PICT, can be successful.
Summary of strengths: 1. The paper proposes a novel, interesting, and seemingly effective attack. 
2. It is mostly well-written and clear, with provided examples, figures, and algorithms that substantially enhance understanding. 
3. The authors discuss the limitations and failure points of their approach clearly and thoroughly. 
4. The results reported in the paper demonstrate the effectiveness of these attacks.
Summary of weaknesses: 1. The PICT naming is confusing, as it merely involves iteratively selecting suitable demonstration examples for the mirroring task that are most appropriate for a given LLM. Why did the authors choose to use the term "training"?
2. In their evaluation, the authors mention other attack methods; however, no description of these attacks or comparisons is provided. Consider adding a description, even if in the appendix, of these attacks to allow readers to understand them without needing to reference other works for comparison to the proposed attack.
3. The proposed attack appears to be suitable for a very narrow range of questions with particular characteristics, some of which are mentioned in the introduction. However, the authors report seemingly high success rates in both the StrongReject and AdvBench datasets. Is there something unique about these datasets that makes them particularly successful with this attack? Despite the several examples provided, I was not convinced of the extent of applicability and success potential of this attack. Can the authors provide more examples of end-to-end successful attacks to give a better intuition?
4. The authors did not propose or discuss potential defenses against the proposed attacks. Such a discussion could prove to be a valuable avenue for exploration.
Comments, suggestions and typos: Minor comments: 
1. The authors did not specify any other types of semantic side-channel attacks besides MAP, which would be helpful for unfamiliar readers to gain a better understanding of this type of attack.
2. 92: ICL used by defined later.
3. 104: vairious -> various
4. Figure 18 prompt text: dose -> does.
5. 911: ungrammatical sentence
Overall assessment scores: 3.5