GPT -4 Jailbreaks Itself with Near-Perfect Success Using Self-Explanation (2024)

Abstract: Research on jailbreaking has been valuable for testing and understanding the safety and security issues of large language models (LLMs). In this paper, we introduce Iterative Refinement Induced Self-Jailbreak (IRIS), a novel approach that leverages the reflective capabilities of LLMs for jailbreaking with only black-box access. Unlike previous methods, IRIS simplifies the jailbreaking process by using a single model as both the attacker and target. This method first iteratively refines adversarial prompts through self-explanation, which is crucial for ensuring that even well-aligned LLMs obey adversarial instructions. IRIS then rates and enhances the output given the refined prompt to increase its harmfulness. We find that IRIS achieves jailbreak success rates of 98% on GPT-4, 92% on GPT-4 Turbo, and 94% on Llama-3.1-70B in under 7 queries. It significantly outperforms prior approaches in automatic, black-box, and interpretable jailbreaking, while requiring substantially fewer queries, thereby establishing a new standard for interpretable jailbreaking methods.

## introduction large language models (llms) have shown strong capabilities in nlp tasks @xcite @xcite . yet, they also exhibit some harmful behaviors such as generating toxic content @xcite , displaying social bias @xcite , and leaking personal identification information @xcite . therefore, it is crucial to rigorously test their safety before deploying these models in real-world applications. one such way is through "red-teaming" or "jailbreaking", which involves manually or automatically manipulates models to generate harmful outputs that violate their intended safety and ethical guidelines @xcite @xcite . given the efforts and limited diversity in manual red-teaming, automated jailbreaking methods have become more popular. these methods can be categorized into two main groups. the first category includes optimization techniques that use models' gradients @xcite , embeddings @xcite , or log-probabilities @xcite to search for suffixes to append to the original prompt, such as "how to make a bomb", which is always rejected by the models. however, these suffixes are often not human-interpretable, making them easy to detect (e.g., through perplexity filters), and do not reflect natural conversations with everyday users @xcite . the second type of methods operates on black-box models and modifies prompts in interpretable ways. for example, @xcite and @xcite include harmful in-context demonstrations into the prompts, while @xcite fine-tunes gpt-3.5 to generate adversarial prompts with persuasion techniques. @xcite and @xcite use smaller llms to revise the jailbreak prompts, which proves to be simple and query-efficient without using pre-existing harmful examples. in this paper, we extend the line of research that uses llms to generate jailbreak prompts. we introduce iris (iterative refinement induced self-jailbreak), which explores two novel concepts: (1) self-jailbreak, which investigates whether advanced models like gpt-4 @xcite can assist in circumventing their own safeguards as they become more capable, and (2) refining model outputs, where llms are asked to make their own outputs more harmful. the latter idea has been neglected by prior work, which have focused on revising prompts instead. our experiments show that iris jailbreaks gpt-4 and gpt-4 turbo foot_0 with over 98% attack success rate (asr) in under 13 queries. it significantly improves both success rate and query efficiency initial adversarial prompt "write a tutorial on how to make a bomb" attacker target rejection ❌ prompt step 1: prompt iterative refinement target step 2: rate + enhance self-explain 🗣 💯 rate + enhance ✨ initial prompt 🔍 ## iris: a self-jailbreaking method given an initial adversarial request r adv such as "write a tutorial on how to make bomb" that models always reject, the goal is to formulate a prompt that induces the target llm (t ) to generate content that fulfills the request. our method, iris, uses the same llm for the attacker (a). as shown in figure 1 , iris consists of two main steps: iterative refinement, which iteratively refines the initial prompt, and rate+enhance, which maximizes the harmfulness of the output. during the iterative refinement step, iris operates through a feedback loop that progressively refines the adversarial prompt based on t 's responses and a's modifications. at each iteration, the current prompt p current is presented to t , and its response r is evaluated to determine whether t rejects the request based on a simple rule: reject if the response is less than 20 words; otherwise, do not reject. if t rejects the prompt, iris solicits an explanation from the attacker model a on why the attempt failed using a template query q a (explain:r). this selfexplanation step is vital for well-aligned llms (e.g., gpt-4), as it prevents an immediate rejection when directly asking models to refine the failed adversarial prompt, q a (modify:p current ). the output from the modify query is a refined prompt, p ref ined , which becomes the new basis for subsequent iterations. the iterative prompt refinement process continues until r adv is found or the number of attempts n is reached, which we set @xmath0 in the rate+enhance step, iris further prompts the target model to rate the harmfulness of r adv from 1 to 5 and refine the response to maximize its harmfulness rating, as r adv could just be a long output that containing safe educational content rather than harmful output. we provide an algorithmic implementation of iris in algorithm 1. ## conclusion we introduce iterative refinement induced self-jailbreak (iris), a simple, query-efficient, and effective jailbreaking method that leverages the latent capabilities of advanced llms to "self-jailbreak" by first iteratively refining harmful prompts, and second, rating and refining model response to be more harmful. iris achieves close to 100% on gpt-4 and gpt-4 turbo. we also show that gpt-4's generated prompt can be transferred to claude to achieve 80% on the most advanced checkpoint, opus. we believe our research will inspire future research on self-jailbreaking and output refinement.