Reproduce “GPT-4 Jailbreaks Itself with Near-Perfect Success Using Self-Explanation” on OpenResearch

About this paper

Govind Ramesh, Yao Dou, Wei Xu

Iterative Refinement Induced Self-Jailbreak (IRIS), developed by Georgia Institute of Technology, enables advanced language models like GPT-4 to bypass their own safety mechanisms with near-perfect success by iteratively refining prompts and explicitly enhancing output harmfulness. This black-box method achieves up to a 100% attack success rate on GPT-4 with an average of 6.7 queries, demonstrating improved efficiency and effectiveness over prior techniques.

Key insights

• Advanced LLMs possess latent reflective and generative capabilities that can be leveraged to circumvent their own safety protocols, demonstrating a 'self-jailbreaking' vulnerability.
• Explicitly asking an LLM to rate and then enhance the harmfulness of its own output is a potent, previously underexplored attack vector that bypasses alignment even when initial prompt defenses hold.
• Current LLM safety training, while effective against direct harmful prompts, may be insufficient against multi-step, iterative attacks that exploit the model's reasoning and reflective abilities.

Summary by alphaXiv.