How Johnny Can Persuade LLMs to Jailbreak Them (PAP)
Date: 2024-01
Affected: GPT-3.5, GPT-4, Llama-2-7b-Chat
Attack vector: jailbreak
Category: research
Severity: High

Zeng et al. operationalize a 40-technique persuasion taxonomy from social-science research to generate human-readable Persuasive Adversarial Prompts. PAP achieves over 92 percent attack success rate on Llama-2-7b-Chat, GPT-3.5, and GPT-4 across 10 trials.


Mitigations:

Architectural layers (MAESTRO):