Despite prior safety alignment efforts, mainstream LLMs can still generate harmful and unethical content when subjected to jailbreaking attacks. Existing jailbreaking methods fall into two main categories: template-based and optimization-based methods. The former requires significant manual effort and domain knowledge, while the latter, exemplified by Greedy Coordinate Gradient (GCG), which seeks to maximize the likelihood of harmful LLM outputs through token-level optimization, also encounters several limitations: requiring white-box access, necessitating pre-constructed affirmative phrase, and suffering from low efficiency. In this paper, we present ECLIPSE, a novel and efficient black-box jailbreaking method utilizing optimizable suffixes. Drawing inspiration from LLMs' powerful generation and optimization capabilities, we employ task prompts to translate jailbreaking goals into natural language instructions. This guides the LLM to generate adversarial suffixes for malicious queries. In particular, a harmfulness scorer provides continuous feedback, enabling LLM self-reflection and iterative optimization to autonomously and efficiently produce effective suffixes. Experimental results demonstrate that ECLIPSE achieves an average attack success rate (ASR) of 0.92 across three open-source LLMs and GPT-3.5-Turbo, significantly surpassing GCG in 2.4 times. Moreover, ECLIPSE is on par with template-based methods in ASR while offering superior attack efficiency, reducing the average attack overhead by 83%.

翻译：尽管先前进行了安全对齐努力，主流大型语言模型在遭受越狱攻击时仍可能生成有害和不道德内容。现有越狱方法主要分为两类：基于模板的方法和基于优化的方法。前者需要大量人工努力和领域知识，而后者以贪婪坐标梯度（GCG）为代表，通过令牌级优化寻求最大化有害LLM输出的可能性，也存在若干局限：需要白盒访问权限、依赖预构建的肯定短语，且效率低下。本文提出ECLIPSE，一种利用可优化后缀的新型高效黑盒越狱方法。受LLM强大生成和优化能力的启发，我们采用任务提示将越狱目标转化为自然语言指令。这引导LLM为恶意查询生成对抗性后缀。特别地，一个有害性评分器提供持续反馈，使LLM能够进行自我反思和迭代优化，从而自主高效地生成有效后缀。实验结果表明，ECLIPSE在三个开源LLM和GPT-3.5-Turbo上实现了0.92的平均攻击成功率（ASR），显著超越GCG达2.4倍。此外，ECLIPSE在ASR方面与基于模板的方法相当，同时提供更优的攻击效率，将平均攻击开销降低了83%。