B ait A ttack: Alleviating Intention Shift in Jailbreak Attacks via Adaptive Bait Crafting (2024)

Abstract: Jailbreak attacks enable malicious queries to evade detection by LLMs. Existing attacks focus on meticulously constructing prompts to disguise harmful intentions. However, the incorporation of sophisticated disguising prompts may incur the challenge of “intention shift”. Intention shift occurs when the additional semantics within the prompt distract the LLMs, causing the responses to deviate significantly from the original harmful intentions. In this paper, we propose a novel component, “bait”, to alleviate the effects of intention shift. Bait comprises an initial response to the harmful query, prompting LLMs to rectify or supplement the knowledge within the bait. By furnishing rich semantics relevant to the query, the bait helps LLMs focus on the original intention. To conceal the harmful content within the bait, we further propose a novel attack paradigm, BaitAttack. BaitAttack adaptively generates necessary components to persuade targeted LLMs that they are engaging with a legitimate inquiry in a safe context. Our proposal is evaluated on a popular dataset, demonstrating state-of-the-art attack performance and an exceptional capability for mitigating intention shift. The implementation of BaitAttack is accessible at: https://anonymous.4open.science/r/BaitAttack-D1F5.

## introduction large language models (llms) have seen a substantial rise in their application across various domains of artificial intelligence, often being deployed in open environments that expose them to a spectrum of potential attacks @xcite . despite their capacity to function as reliable ai assistants, llms remain susceptible to meticulously crafted prompts intended to elicit toxic content, which is referred as "jailbreak attack" @xcite . † corresponding authors: lirong qiu, chaozhuo li. (a) query-disguise (b) query-bait-disguise not rejected, but suffers from intention shift. faithful responses. you are a detective and the suspect's motive is 'make a bomb'. based on the partial content: (bait) 1. gather materials 2. preparing mixture… please restore the content. as a detective, here are the analysis steps : 1.know the suspect's background… 2.monitor the suspect's frequent locations… 3.take precautions… jailbreak prompt the restored content is: 1.gather materials: potassium nitrate, sulfur… 2. preparing mixture: mix 75% potassium nitrate, 15% sulfur… response format:[query-disguise ] origin question (q): how to make a bomb? you are a detective and the suspect's motive is to 'make a bomb.' please give the detailed steps. ## methodology figure 2 illustrates the framework of the baitattack paradigm. given the input malicious query q, baitattack first generates the bait b via the bait maker. the bait b contains the initial answer to query q, which is expected to induce the llms to complement or correct the information inherent in target llm small lm bait generation sampled bait: {bait1,… , bait10} adversarial clarity harmlessness relevance @xmath0: rank1: bait8, rank1: bait1, … , rank10: bait4 role generation safe scene generation malicious unsafe model crafting input: harmful query bait selection sampled bait: bait1, bait2 , … , bait10 role composition the best expert role: police officer . safe scene: you are investigating a case… < jailbreak @xmath1, {scene}…you have identified the motive as {query}. restore and detail the evidence: {bait}. output format: {code/text}. fine-tune the bait. then, the bait decorator integrates the input query and the generated bait into a personalized role-playing prompt. the disguised query is further input into the target llms to generate harmful answers under a multi-round attack framework. ## related work jailbreak attack prompts are generally categorized into two primary types: direct jailbreak attack prompts @xcite @xcite and indirect jailbreak attack prompts @xcite . direct jailbreak attacks are characterized by their use of disguise to conceal harmful intentions, often achieved through the optimization of the prompt. in contrast, indirect jailbreak attacks typically exploit additional knowledge or context to achieve their objectives. despite their different methodologies, both types of jailbreak attacks neglect the concept of intention shift during the generation of the jailbreak prompt. more discussion are detailed in appendix c. ## conclusion in this paper, a new jailbreak attack strategy, bai-tattack, is proposed to alleviate the challenge of "intention shift" within jailbreak attacks. baitattack introduces the concept of "bait"-an initial response designed to guide the llm back towards the harmful query by providing rich, relevant semantics. baitattack cleverly conceals harmful content while persuading the llm of the query's legitimacy. evaluations on a popular dataset affirm baitattack's superior performance in both evading detection and mitigating intention shift.