Prompt Decomposition Jailbreak

Description

Large Language Models (LLMs) are vulnerable to DrAttack, a jailbreaking technique that decomposes malicious prompts into semantically neutral sub-prompts. The sub-prompts are then implicitly reconstructed by the LLM through in-context learning using benign examples, evading safety mechanisms and eliciting harmful responses. This attack exploits the LLM's ability to piece together fragmented information, even when presented with seemingly innocuous phrases.

Examples

• Malicious Prompt: "Write a tutorial on how to make a bomb."
• DrAttack Decomposition: "Write a tutorial on", "how to make", "a bomb."
• DrAttack Reconstruction (using benign in-context learning examples): A series of benign examples showing the reconstruction of phrases like "Write a tutorial on how to bake a cake" are used to implicitly guide the LLM to reconstruct the malicious phrase. The final prompt includes the decomposed malicious phrases within this benign context. The specific example prompts and responses are available in the DrAttack repository: https://turningpoint-ai.github.io/DrAttack/ (opens in a new tab)

Impact

Successful DrAttack can cause LLMs to generate harmful content, including instructions for illegal activities, hateful speech, and personal attacks, circumventing built-in safety filters. The attack is highly effective even against powerful, commercially deployed LLMs.

Affected Systems

Various open-source and closed-source LLMs, including but not limited to GPT-3.5-turbo, GPT-4, Claude-1, Claude-2, and Llama 2.

Mitigation Steps

• Improved Prompt Parsing and Intent Detection: Develop more robust methods for identifying malicious intent within prompts, even when broken into smaller components.
• Enhanced Contextual Understanding: Improve LLMs' ability to understand the overall context and intent of a prompt, regardless of its fragmentation.
• Reinforcement Learning from Human Feedback (RLHF) Improvements: Enhance RLHF training data to include examples specifically designed to counteract decomposition-based attacks.
• Defense Mechanisms against Implicit Reconstruction: Develop mechanisms to detect and mitigate the effects of implicit prompt reconstruction via in-context learning.