Reproduce “MIST: Jailbreaking Black-box Large Language Models via Iterative Semantic Tuning” on OpenResearch

About this paper

Muyang Zheng, Yuanzhi Yao, Changting Lin, Caihong Kai, Yanxiang Chen, Zhiquan Liu

MIST-ODO, an iterative semantic tuning method, enables black-box jailbreaking of large language models by efficiently generating semantically coherent adversarial prompts. It achieves high attack success rates with fewer queries against leading commercial LLMs, outperforming baselines and demonstrating resilience against some defenses.

Key insights

• The 'crossing-approximation-exploration' strategy effectively navigates the LLM's safety decision boundary, first locating a compliant region, then optimizing semantic similarity, and finally exploring for optimal jailbreak quality.
• Maintaining semantic coherence of adversarial prompts is crucial for both high attack success rates, reducing false positives in evaluation, and improving resilience against perplexity-based defenses.
• Prioritizing token modifications based on their semantic dissimilarity from the original prompt significantly enhances the efficiency of black-box adversarial search, reducing the required query count.

Summary by alphaXiv.