One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs

Safety alignment in large language models (LLMs) is increasingly compromised by jailbreak attacks, which can manipulate these models to generate harmful or unintended content. Investigating these attacks is crucial for uncovering model vulnerabilities. However, many existing jailbreak strategies fail to keep pace with the rapid development of defense mechanisms, such as defensive suffixes, rendering them ineffective against defended models. To tackle this issue, we introduce a novel attack method called ArrAttack, specifically designed to target defended LLMs. ArrAttack automatically generates robust jailbreak prompts capable of bypassing various defense measures. This capability is supported by a universal robustness judgment model that, once trained, can perform robustness evaluation for any target model with a wide variety of defenses. By leveraging this model, we can rapidly develop a robust jailbreak prompt generator that efficiently converts malicious input prompts into effective attacks. Extensive evaluations reveal that ArrAttack significantly outperforms existing attack strategies, demonstrating strong transferability across both white-box and black-box models, including GPT -4 and Claude-3. Our work bridges the gap between jailbreak attacks and defenses, providing a fresh perspective on generating robust jailbreak prompts. Large Language Models (LLMs) have demonstrated exceptional capabilities in areas such as intelligent question answering, code generation, and logical reasoning (Zhuang et al., 2024; Zheng et al., 2023; Creswell et al., 2023). As these models become increasingly integrated into real-world applications, ensuring their safety has become a critical concern. Consequently, most mainstream LLMs now undergo a "safety alignment" process prior to deployment, in which models are fine-tuned to better align with human preferences and societal ethical standards (Ouyang et al., 2022; Rafailov et al., 2024; Korbak et al., 2023; Wang et al., 2023). However, even with safety alignment, LLMs remain vulnerable to jailbreaking attacks, which can lead them to produce outputs that contravene established safety principles (Perez et al., 2022; Wei et al., 2024; Carlini et al., 2024). Currently, a wide variety of jailbreak attacks against LLMs have been developed, including optimization-based, template-based, and rewriting-based attacks. Optimization-based attacks leverage gradients to manipulate model inputs toward an affirmative response, prompting the model to produce harmful content (Zou et al., 2023; Liao & Sun, 2024).