Reproduce “Model-Editing-Based Jailbreak against Safety-aligned Large Language Models” on OpenResearch

About this paper

Yuxi Li, Zhibo Zhang, Kailong Wang, Ling Shi, Haoyu Wang

Researchers from Huazhong University of Science and Technology and Nanyang Technological University introduced Targeted Model Editing (TME), a white-box jailbreak method that directly modifies Large Language Model (LLM) internal Multi-Layer Perceptron (MLP) layers to circumvent safety mechanisms. This technique, integrated into the D-LLM framework, achieved an average attack success rate of 84.86% across four open-source LLMs while largely preserving normal model functionality.

Key insights

• Safety mechanisms in LLMs primarily induce distinct and consistent activation patterns within Multi-Layer Perceptron (MLP) layers for unsafe queries, leading to high consistency in refusal responses.
• The "Safety-Critical Transformations" (SCTs) responsible for safety alignment can be formally approximated and effectively removed by targeted modifications to specific MLP matrices.
• A successful and stealthy model-editing-based jailbreak requires a multi-objective optimization that simultaneously retains safe sample behavior, transforms unsafe sample processing, and preserves overall model functionality.

Summary by alphaXiv.