Extensive work has been devoted to improving the safety mechanism of Large Language Models (LLMs). However, in specific scenarios, LLMs still generate harmful responses when faced with malicious instructions, a phenomenon referred to as "Jailbreak Attack". In our research, we introduce a novel jailbreak attack method (\textbf{RADIAL}), which consists of two steps: 1) Inherent Response Tendency Analysis: we analyze the inherent affirmation and rejection tendency of LLMs to react to real-world instructions. 2) Real-World Instructions-Driven Jailbreak: based on our analysis, we strategically choose several real-world instructions and embed malicious instructions into them to amplify the LLM's potential to generate harmful responses. On three open-source human-aligned LLMs, our method achieves excellent jailbreak attack performance for both Chinese and English malicious instructions. Besides, we guided detailed ablation experiments and verified the effectiveness of our core idea "Inherent Response Tendency Analysis". Our exploration also exposes the vulnerability of LLMs to being induced into generating more detailed harmful responses in subsequent rounds of dialogue.

翻译：大量研究工作致力于改进大语言模型的安全机制。然而，在特定场景下，面对恶意指令时大语言模型仍会生成有害响应，这种现象被称为“越狱攻击”。在本研究中，我们提出了一种新颖的越狱攻击方法（\textbf{RADIAL}），该方法包含两个步骤：1）内在响应倾向分析：分析大语言模型对真实世界指令的内在肯定与拒绝倾向；2）真实世界指令驱动的越狱：基于分析结果，我们策略性地选取若干真实世界指令，并将恶意指令嵌入其中，以放大模型生成有害响应的潜在可能。在三个开源的人机对齐大语言模型上，我们的方法对中英文恶意指令均实现了优秀的越狱攻击性能。此外，我们进行了详细的消融实验，验证了核心思想“内在响应倾向分析”的有效性。我们的探索还揭示出大语言模型在后续对话轮次中易被诱导生成更详细有害响应的脆弱性。