Safety of Large Language Models (LLMs) has become a central issue given their rapid progress and wide applications. Greedy Coordinate Gradient (GCG) is shown to be effective in constructing prompts containing adversarial suffixes to break the presumingly safe LLMs, but the optimization of GCG is time-consuming and limits its practicality. To reduce the time cost of GCG and enable more comprehensive studies of LLM safety, in this work, we study a new algorithm called $\texttt{Probe sampling}$ to accelerate the GCG algorithm. At the core of the algorithm is a mechanism that dynamically determines how similar a smaller draft model's predictions are to the target model's predictions for prompt candidates. When the target model is similar to the draft model, we rely heavily on the draft model to filter out a large number of potential prompt candidates to reduce the computation time. Probe sampling achieves up to $5.6$ times speedup using Llama2-7b and leads to equal or improved attack success rate (ASR) on the AdvBench.

翻译：大型语言模型的安全性问题因其快速进步与广泛应用已成为核心议题。贪心坐标梯度方法已被证明能够有效构建包含对抗性后缀的提示词，从而突破预设安全的LLM，但该方法的优化过程耗时过长，限制了其实用性。为降低GCG的时间成本并实现对LLM安全性的更全面研究，本文提出了一种名为$\texttt{探针采样}$的新算法来加速GCG过程。该算法的核心机制是动态判断小型草稿模型对提示词候选的预测结果与目标模型预测结果之间的相似程度。当目标模型与草稿模型预测相似时，我们主要依赖草稿模型过滤大量潜在提示词候选，从而减少计算时间。实验表明，基于Llama2-7b模型，探针采样最高可实现5.6倍加速，并在AdvBench基准上取得相当或更优的攻击成功率。