Despite remarkable success in various applications, large language models (LLMs) are vulnerable to adversarial jailbreaks that make the safety guardrails void. However, previous studies for jailbreaks usually resort to brute-force optimization or extrapolations of a high computation cost, which might not be practical or effective. In this paper, inspired by the Milgram experiment w.r.t. the authority power for inciting harmfulness, we disclose a lightweight method, termed as DeepInception, which can hypnotize an LLM to be a jailbreaker. Specifically, DeepInception leverages the personification ability of LLM to construct a virtual, nested scene to jailbreak, which realizes an adaptive way to escape the usage control in a normal scenario. Empirically, DeepInception can achieve competitive jailbreak success rates with previous counterparts and realize a continuous jailbreak in subsequent interactions, which reveals the critical weakness of self-losing on both open-source and closed-source LLMs like Falcon, Vicuna-v1.5, Llama-2, GPT-3.5, and GPT-4. The code is publicly available at: https://github.com/tmlr-group/DeepInception.

翻译：尽管大型语言模型（LLMs）在各种应用中取得了显著成功，但其易受对抗性越狱攻击的影响，导致安全防护措施失效。然而，以往的越狱研究通常依赖于计算成本高昂的暴力优化或外推方法，这些方法可能既不实用也不高效。本文受米尔格拉姆实验中关于权威力量诱发有害行为的启发，提出了一种轻量级方法——DeepInception，该方法能够催眠LLM使其成为越狱者。具体而言，DeepInception利用LLM的拟人化能力，构建一个虚拟的、嵌套的场景来实现越狱，从而以自适应方式规避正常场景下的使用控制。实证研究表明，DeepInception能够达到与先前方法相当的越狱成功率，并在后续交互中实现持续性越狱，这揭示了包括Falcon、Vicuna-v1.5、Llama-2、GPT-3.5和GPT-4在内的开源与闭源LLM均存在自我迷失的关键弱点。代码已公开于：https://github.com/tmlr-group/DeepInception。