Reproduce “Endless Jailbreaks with Bijection Learning” on OpenResearch

About this paper

Brian R.Y. Huang, Maximilian Li, Leonard Tang

This research introduces 'bijection learning,' a novel black-box attack method that automatically discovers safety vulnerabilities in Large Language Models by teaching them arbitrary string-to-string encodings through in-context learning. The method achieves high attack success rates, such as 86.3% on Claude 3.5 Sonnet, and demonstrates that increased model capabilities can paradoxically lead to new emergent vulnerabilities.

Key insights

• Increased LLM capabilities, particularly in-context learning and complex reasoning, can introduce new emergent vulnerabilities that challenge the notion of inherent safety with scale.
• The 'computational overload hypothesis' suggests that simultaneous demands of translation, answering, and safety classification can overwhelm models, leading to safety guardrail failures.
• More capable models demonstrate higher attack success rates at specific bijection complexities, indicating they are more susceptible to sophisticated jailbreaks that leverage their advanced abilities.

Summary by alphaXiv.