https://arxiv.org/abs/2412.03556

Change to arXiv's privacy policy

The arXiv Privacy Policy has changed. By continuing to use arxiv.org,
you are agreeing to the privacy policy.

I Understand
Skip to main content
Cornell University
We gratefully acknowledge support from the Simons Foundation, member
institutions, and all contributors. Donate
 
arxiv logo > cs > arXiv:2412.03556
[                    ]

Help | Advanced Search

[All fields        ]
Search
arXiv logo
Cornell University Logo
[                    ] GO
quick links

  * Login
  * Help Pages
  * About

Computer Science > Computation and Language

arXiv:2412.03556 (cs)
[Submitted on 4 Dec 2024]

Title:Best-of-N Jailbreaking

Authors:John Hughes, Sara Price, Aengus Lynch, Rylan Schaeffer, Fazl
Barez, Sanmi Koyejo, Henry Sleight, Erik Jones, Ethan Perez, Mrinank
Sharma
View a PDF of the paper titled Best-of-N Jailbreaking, by John Hughes
and 9 other authors
View PDF HTML (experimental)

    Abstract:We introduce Best-of-N (BoN) Jailbreaking, a simple
    black-box algorithm that jailbreaks frontier AI systems across
    modalities. BoN Jailbreaking works by repeatedly sampling
    variations of a prompt with a combination of augmentations - such
    as random shuffling or capitalization for textual prompts - until
    a harmful response is elicited. We find that BoN Jailbreaking
    achieves high attack success rates (ASRs) on closed-source
    language models, such as 89% on GPT-4o and 78% on Claude 3.5
    Sonnet when sampling 10,000 augmented prompts. Further, it is
    similarly effective at circumventing state-of-the-art open-source
    defenses like circuit breakers. BoN also seamlessly extends to
    other modalities: it jailbreaks vision language models (VLMs)
    such as GPT-4o and audio language models (ALMs) like Gemini 1.5
    Pro, using modality-specific augmentations. BoN reliably improves
    when we sample more augmented prompts. Across all modalities,
    ASR, as a function of the number of samples (N), empirically
    follows power-law-like behavior for many orders of magnitude. BoN
    Jailbreaking can also be composed with other black-box algorithms
    for even more effective attacks - combining BoN with an optimized
    prefix attack achieves up to a 35% increase in ASR. Overall, our
    work indicates that, despite their capability, language models
    are sensitive to seemingly innocuous changes to inputs, which
    attackers can exploit across modalities.

Subjects: Computation and Language (cs.CL); Artificial Intelligence
          (cs.AI); Machine Learning (cs.LG)
Cite as:  arXiv:2412.03556 [cs.CL]
          (or arXiv:2412.03556v1 [cs.CL] for this version)
          https://doi.org/10.48550/arXiv.2412.03556
          Focus to learn more
          arXiv-issued DOI via DataCite

Submission history

From: Sara Price [view email]
[v1] Wed, 4 Dec 2024 18:51:32 UTC (12,075 KB)
Full-text links:

Access Paper:

    View a PDF of the paper titled Best-of-N Jailbreaking, by John
    Hughes and 9 other authors
  * View PDF
  * HTML (experimental)
  * TeX Source
  * Other Formats

license icon view license
Current browse context:
cs.CL
< prev   |   next >
new | recent | 2024-12
Change to browse by:
cs
cs.AI
cs.LG

References & Citations

  * NASA ADS
  * Google Scholar
  * Semantic Scholar

a export BibTeX citation Loading...

BibTeX formatted citation

x
[loading...          ]
Data provided by:

Bookmark

BibSonomy logo Reddit logo
(*) Bibliographic Tools

Bibliographic and Citation Tools

[ ] Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
[ ] Connected Papers Toggle
Connected Papers (What is Connected Papers?)
[ ] Litmaps Toggle
Litmaps (What is Litmaps?)
[ ] scite.ai Toggle
scite Smart Citations (What are Smart Citations?)
( ) Code, Data, Media

Code, Data and Media Associated with this Article

[ ] alphaXiv Toggle
alphaXiv (What is alphaXiv?)
[ ] Links to Code Toggle
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
[ ] DagsHub Toggle
DagsHub (What is DagsHub?)
[ ] GotitPub Toggle
Gotit.pub (What is GotitPub?)
[ ] Huggingface Toggle
Hugging Face (What is Huggingface?)
[ ] Links to Code Toggle
Papers with Code (What is Papers with Code?)
[ ] ScienceCast Toggle
ScienceCast (What is ScienceCast?)
( ) Demos

Demos

[ ] Replicate Toggle
Replicate (What is Replicate?)
[ ] Spaces Toggle
Hugging Face Spaces (What is Spaces?)
[ ] Spaces Toggle
TXYZ.AI (What is TXYZ.AI?)
( ) Related Papers

Recommenders and Search Tools

[ ] Link to Influence Flower
Influence Flower (What are Influence Flowers?)
[ ] Core recommender toggle
CORE Recommender (What is CORE?)

  * Author
  * Venue
  * Institution
  * Topic

( ) About arXivLabs

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and
share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have
embraced and accepted our values of openness, community, excellence,
and user data privacy. arXiv is committed to these values and only
works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community?
Learn more about arXivLabs.

Which authors of this paper are endorsers? | Disable MathJax (What is
MathJax?)

  * About
  * Help

  * Click here to contact arXiv Contact
  * Click here to subscribe Subscribe

  * Copyright
  * Privacy Policy

  * Web Accessibility Assistance
  * arXiv Operational Status
    Get status notifications via email or slack