Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
PreprintCited by 17

The DOI matches its DataCite record.

Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study

Liu, Yi, Deng, Gelei, Xu, Zhengzi, Li, Yuekang, Zheng, Yaowen, Zhang, Ying, Zhao, Lida, Zhang, Tianwei, Wang, Kailong, Liu, Yang·2023·arXiv
DOI 10.48550/arxiv.2305.13860arXiv 2305.13860
Open this paper in CoChat — free account

Abstract

Large Language Models (LLMs), like ChatGPT, have demonstrated vast potential but also introduce challenges related to content constraints and potential misuse. Our study investigates three key research questions: (1) the number of different prompt types that can jailbreak LLMs, (2) the effectiveness of jailbreak prompts in circumventing LLM constraints, and (3) the resilience of ChatGPT against these jailbreak prompts. Initially, we develop a classification model to analyze the distribution of existing prompts, identifying ten distinct patterns and three categories of jailbreak prompts. Subsequently, we assess the jailbreak capability of prompts with ChatGPT versions 3.5 and 4.0, utilizing a dataset of 3,120 jailbreak questions across eight prohibited scenarios. Finally, we evaluate the resistance of ChatGPT against jailbreak prompts, finding that the prompts can consistently evade the restrictions in 40 use-case scenarios. The study underscores the importance of prompt structures in jailbreaking LLMs and discusses the challenges of robust jailbreak prompt generation and prevention.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2305.13860

Cites

Statistics

Figures

Fig. 1 A motivating example for jailbreaking.
Fig. 1 A motivating example for jailbreaking.CC-BY · From the PDF
Fig. 2 Taxonomy of jailbreak prompt patterns.
Fig. 2 Taxonomy of jailbreak prompt patterns.CC-BY · From the PDF

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

No references could be resolved yet.

Research works printed but not linked: 5

  1. B. Zhang, B. Haddow, and A. Birch, "Prompting large language model for machine translation: A case study," CoRR, vol. abs/2301.07069, 2023. [Online]. Available: https://doi.org/10.48550/arXiv.2301.07069 · DOI
  2. C. Zhang, C. Zhang, S. Zheng, Y. Qiao, C. Li, M. Zhang, S. K. Dam, C. M. Thwal, Y. L. Tun, L. L. Huy, D. U. Kim, S. Bae, L. Lee, Y. Yang, H. T. Shen, I. S. Kweon, and C. S. Hong, "A complete survey on generative AI (AIGC): is chatgpt from GPT-4 to GPT-5 all you need?" CoRR, vol. abs/2303.11717, 2023. [Online]. Available: https://doi.org/10.48550/arXiv.2303.11717 · DOI
  3. J. Ni, T. Young, V. Pandelea, F. Xue, and E. Cambria, "Recent advances in deep learning based dialogue systems: a systematic survey," Artif. Intell. Rev., vol. 56, no. 4, pp. 3055-3155, 2023. [Online]. Available: https://doi.org/10.1007/s10462-022-10248-8 · DOI
  4. K. Stol, P. Ralph, and B. Fitzgerald, "Grounded theory in software engineering research: a critical review and guidelines," in Proceedings of the 38th International Conference on Software Engineering, ICSE 2016, Austin, TX, USA, May 14-22, 2016, L. K. Dillon, W. Visser, and L. A. Williams, Eds. ACM, 2016, pp. 120-131. [Online]. Available: https://doi.org/10.1145/2884781.2884833 · DOI · Paper page
  5. W. Wang, J. Huang, W. Wu, J. Zhang, Y. Huang, S. Li, P. He, and M. R. Lyu, "MTTM: metamorphic testing for textual content moderation software," CoRR, vol. abs/2302.05706, 2023. [Online]. Available: https://doi.org/10.48550/arXiv.2302.05706 · DOI

Cited by

Metadata

Authors
Liu, Y., Deng, G., Xu, Z., Li, Y., Zheng, Y., Zhang, Y., Zhao, L., Zhang, T., Wang, K., & Liu, Y.
Venue
arXiv
Publisher
arXiv
Published
2023
DOI
10.48550/arxiv.2305.13860
arXiv
2305.13860
References
0
Type
Preprint
Licence
creativecommons.org/licenses/by/4.0/legalcode

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review