Current LLM alignment methods are readily broken through specifically crafted adversarial prompts. While crafting adversarial prompts using discrete optimization is highly effective, such attacks typically use more than 100,000 LLM calls. This high computational cost makes them unsuitable for, e.g., quantitative analyses and adversarial training. To remedy this, we revisit Projected Gradient Descent (PGD) on the continuously relaxed input prompt. Although previous attempts with ordinary gradient-based attacks largely failed, we show that carefully controlling the error introduced by the continuous relaxation tremendously boosts their efficacy. Our PGD for LLMs is up to one order of magnitude faster than state-of-the-art discrete optimization to achieve the same devastating attack results.

翻译：当前大语言模型的对齐方法容易通过精心构造的对抗性提示被攻破。虽然使用离散优化构造对抗性提示效果显著，但此类攻击通常需要调用超过10万次大语言模型。这种高昂的计算成本使其难以应用于定量分析和对抗训练等场景。为解决这一问题，我们重新审视了在连续松弛输入提示上的投影梯度下降（PGD）方法。尽管以往基于普通梯度的攻击大多效果不佳，但本文证明，通过精细控制连续松弛引入的误差，可极大提升此类攻击的有效性。我们针对大语言模型的PGD方法相比最先进的离散优化方法，在达到同等破坏性攻击效果时，速度提升可达一个数量级。