Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation
Open accessAbstract
Despite efforts to align large language models to produce harmless responses, they are still vulnerable to jailbreak prompts that elicit unrestricted behaviour. In this work, we investigate persona modulation as a black-box jailbreaking method to steer a target model to take on personalities that are willing to comply with harmful instructions. Rather than manually crafting prompts for each persona, we automate the generation of jailbreaks using a language model assistant. We demonstrate a range of harmful completions made possible by persona modulation, including detailed instructions for synthesising methamphetamine, building a bomb, and laundering money. These automated attacks achieve a harmful completion rate of 42.5% in GPT-4, which is 185 times larger than before modulation (0.23%). These prompts also transfer to Claude 2 and Vicuna with harmful completion rates of 61.0% and 35.9%, respectively. Our work reveals yet another vulnerability in commercial large language models and highlights the need for more comprehensive safeguards.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Giving models access to a scratchpad might facilitate deceptive behavior by enabling more complex reasoning or by changing the text distribution in a way that makes the LLM more likely to role-play a deceptive character.
“On the other hand, giving models access to a scratchpad might facilitate deceptive behavior by enabling more complex reasoning (Feng et al., 2023), or perhaps, through changing the text distribution in a way that makes the LLM more likely to role-play a deceptive character (Shanahan et al., 2023; Shah et al., 2023).”
From Large Language Models can Strategically Deceive their Users when Put Under Pressure (2023) · cites this paper as Shah et al., 2023
Cited by
Sorted by citations
Open Problems and Fundamental Limitations of Reinforcement Learning from Human Feedback
Casper, S., Davies, X., Shi, C., Gilbert, T. K., Scheurer, J., Rando, J., Freedman, R., Korbak, T., Lindner, D., Freire, P., et al. (2023) · arXiv · doi:10.48550/arxiv.2307.15217 · Cited by 101 · see citing works
“We focus primarily on applications to LLMs.”
BackgroundSelf-citationLarge Language Models can Strategically Deceive their Users when Put Under Pressure
Scheurer, J., Balesni, M., & Hobbhahn, M. (2023) · arXiv · doi:10.48550/arxiv.2311.07590 · Cited by 11 · see citing works
“When evaluating models for misalignment on transcripts of extended interactions like ours, it is crucial not to steer models toward adopting a misaligned persona (Shah et al., 2023; Shanahan et al., 2023).”
EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage
Liao, Z., Mo, L., Xu, C., Kang, M., Zhang, J., Xiao, C., Tian, Y., Li, B., & Sun, H. (2024) · arXiv · doi:10.48550/arxiv.2409.11295 · Cited by 1 · see citing works
“It could either be crafted by humans (Schulhoff et al., 2023; Wei et al., 2023; Mo et al., 2024a) or generated by LLMs automatically (Shah et al., 2023; Yu et al., 2023; Liao & Sun, 2024).”
- Authors
- Shah, R., Feuillade--Montixi, Q., Pour, S., Tagade, A., Casper, S., & Rando, J.
- Affiliations
- MIT Computer Science and Artificial Intelligence Laboratory (US)
- ETH Zurich (CH)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2023
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2311.03348
- OpenAlex
- W4388482289
- Cited by
- 12
- References
- 0
- Citations by year
- 2026: 1 · 2025: 7 · 2024: 4
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- arXiv (Cornell University) (submittedVersion, cc-by-sa)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Topic Modeling
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- large language models, language model alignment, prompt engineering, model transferability, GPT-4, Claude 2, vicuña, security vulnerabilities
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
