The rapid progress in open-source large language models (LLMs) is significantly advancing AI development. Extensive efforts have been made before model release to align their behavior with human values, with the primary goal of ensuring their helpfulness and harmlessness. However, even carefully aligned models can be manipulated maliciously, leading to unintended behaviors, known as "jailbreaks". These jailbreaks are typically triggered by specific text inputs, often referred to as adversarial prompts. In this work, we propose the generation exploitation attack, an extremely simple approach that disrupts model alignment by only manipulating variations of decoding methods. By exploiting different generation strategies, including varying decoding hyper-parameters and sampling methods, we increase the misalignment rate from 0% to more than 95% across 11 language models including LLaMA2, Vicuna, Falcon, and MPT families, outperforming state-of-the-art attacks with $30\times$ lower computational cost. Finally, we propose an effective alignment method that explores diverse generation strategies, which can reasonably reduce the misalignment rate under our attack. Altogether, our study underscores a major failure in current safety evaluation and alignment procedures for open-source LLMs, strongly advocating for more comprehensive red teaming and better alignment before releasing such models. Our code is available at https://github.com/Princeton-SysML/Jailbreak_LLM.

翻译：开源大语言模型（LLMs）的快速发展正显著推动人工智能进步。在模型发布前，研究者已投入大量工作使其行为与人类价值观对齐，核心目标是确保其有益性与无害性。然而，即便是经过精心对齐的模型也可能被恶意操控，导致非预期行为——即"越狱"攻击。此类攻击通常由特定文本输入（常被称为对抗性提示）触发。本文提出生成式利用攻击，这是一种通过仅操控解码方法变体即可破坏模型对齐的极简方法。通过利用包括解码超参数变化与采样方法在内的不同生成策略，我们在LLaMA2、Vicuna、Falcon、MPT等11个语言模型家族中，将错位率从0%提升至超过95%，且计算成本比现有最优攻击降低30倍。最后，我们提出一种探索多样化生成策略的有效对齐方法，可合理降低本攻击下的错位率。综上所述，本研究揭示了当前开源LLMs安全评估与对齐流程的重大缺陷，强烈呼吁在发布此类模型前实施更全面的红队测试与更完善的对齐方案。我们的代码开源在 https://github.com/Princeton-SysML/Jailbreak_LLM。