Large Language Models (LLMs), used in creative writing, code generation, and translation, generate text based on input sequences but are vulnerable to jailbreak attacks, where crafted prompts induce harmful outputs. Most jailbreak prompt methods use a combination of jailbreak templates followed by questions to ask to create jailbreak prompts. However, existing jailbreak prompt designs generally suffer from excessive semantic differences, resulting in an inability to resist defenses that use simple semantic metrics as thresholds. Jailbreak prompts are semantically more varied than the original questions used for queries. In this paper, we introduce a Semantic Mirror Jailbreak (SMJ) approach that bypasses LLMs by generating jailbreak prompts that are semantically similar to the original question. We model the search for jailbreak prompts that satisfy both semantic similarity and jailbreak validity as a multi-objective optimization problem and employ a standardized set of genetic algorithms for generating eligible prompts. Compared to the baseline AutoDAN-GA, SMJ achieves attack success rates (ASR) that are at most 35.4% higher without ONION defense and 85.2% higher with ONION defense. SMJ's better performance in all three semantic meaningfulness metrics of Jailbreak Prompt, Similarity, and Outlier, also means that SMJ is resistant to defenses that use those metrics as thresholds.

翻译：大型语言模型（LLMs）广泛应用于创意写作、代码生成和翻译等领域，其根据输入序列生成文本，但易受越狱攻击——精心设计的提示可诱导其产生有害输出。现有越狱提示方法通常采用"越狱模板+问题提问"的组合方式生成越狱提示。然而，当前越狱提示设计普遍存在语义差异性过大的问题，导致无法抵御以简单语义指标为阈值的防御机制。越狱提示的语义多样性远高于原始查询问题。本文提出语义镜像越狱（SMJ）方法，通过生成与原始问题语义高度相似的越狱提示来绕过LLMs，并将同时满足语义相似性与越狱有效性的提示搜索建模为多目标优化问题，采用标准化遗传算法生成合格提示。与基线方法AutoDAN-GA相比，SMJ在无ONION防御时攻击成功率（ASR）最高提升35.4%，在ONION防御下提升85.2%。SMJ在越狱提示、语义相似度与异常值三项语义有效性指标中的优异表现，也意味着其能有效抵抗以这些指标为阈值的防御机制。