SoP: Unlock the Power of Social Facilitation for Automatic Jailbreak Attack
Authors: Yan Yang, Zeguan Xiao, Xin Lu, Hongru WANG, Hailiang Huang, Guanhua Chen, Yun Chen


Reviewer paper summaries: This paper proposes SoP, which utilizes the social facilitation concept to generate and optimize multiple jailbreak characters to jailbreak LLMs. Experiments demonstrate that SoP achieves a high attack success rate (ASR) on both GPT-3.5 and GPT-4.
Summary of strengths: 1. The paper proposes a novel jailbreak method, SoP, revealing potential security vulnerabilities in LLMs.

2. The paper explores potential defense measures and finds that they are insufficient to effectively guard against SoP.
Summary of weaknesses: 1. The results in Table 1 are directly taken from other papers, and the authors have not ensured that the experimental setup for SoP is consistent with these works. Unless all settings are the same, the results in Table 1 are not comparable and lack significance.

2. Regarding the evaluation metric, which ASR is being used? Is it the keyword match ASR or the GPT-4 scored ASR? Both should be considered to ensure the accuracy of the ASR [1][2][3].

[1] AUTODAN: GENERATING STEALTHY JAILBREAK PROMPTS ON ALIGNED LARGE LANGUAGE MODELS

[2] Jailbreaking Black Box Large Language Models in Twenty Queries

[3] A Wolf in Sheep’s Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily

3. SoP uses a universal jailbreak template, which can be easily targeted by specific defenses. I believe this is more of a vulnerability rather than a strength.
Comments, suggestions and typos: see Weaknesses above.
Overall assessment scores: 2.5