MRJ-Agent: An Effective Jailbreak Agent for Multi-Round Dialogue

This new attack method proves LLMs are vulnerable to psychological manipulation across multiple chat rounds

Wanna make an LLM spill secrets? Just sweet-talk it for a few rounds!

MRJ-Agent demonstrates how multi-round conversations can systematically break LLM safety barriers

https://arxiv.org/abs/2411.03814

Original Problem 🎯:

LLMs are vulnerable to jailbreak attacks that extract harmful content, especially in multi-round conversations. Current defense mechanisms focus mainly on single-round attacks, leaving a critical gap in protecting against sophisticated multi-round dialogue-based attacks.

-----

Solution in this Paper 🔧:

→ MRJ-Agent introduces a novel multi-round dialogue jailbreaking strategy that breaks down risky queries across multiple conversation rounds

→ Uses information-based control to maintain semantic similarity between generated sub-queries and original harmful query

→ Implements 13 psychological tactics to minimize rejection likelihood from target models

→ Trains a specialized red-team agent that can automatically execute attacks by dynamically adjusting queries based on model responses

-----

Key Insights from this Paper 💡:

→ Multi-round dialogue attacks are more effective than single-round attacks at bypassing safety measures

→ Breaking down harmful queries into seemingly innocent sub-queries helps evade detection

→ Psychological manipulation tactics significantly improve attack success rates

→ Current defense mechanisms are inadequate against sophisticated multi-round attacks

-----

Results 📊:

→ 100% attack success rate on Vicuna-7B and Mistral-7B

→ 92% success rate on LLama2-7B with strong safety abilities

→ ~98-100% success on closed source models (GPT-3.5, GPT-4)

→ 88% success against prompt detection defenses

→ 78% success against system prompt guards