Jailbreaking large language models: A red teaming perspective

Abstract

Despite their remarkable progress in natural language processing, Large Language Models (LLMs) are nevertheless susceptible to jailbreaking - adversarial prompts that circumvent security measures to elicit inappropriate or malicious content. We introduce a taxonomy that covers prompt-based, optimisation-based, multi-turn, and LLM-to-LLM assaults in this paper's thorough red teaming research of jailbreaks. Our tests employ statistical analysis and rigorous multi-run conditions to evaluate four sample LLMs, encompassing both proprietary and open-source systems. According to the results, the most successful suffix attacks are optimisation-based, achieving up to 92.4% success on LLaMA-2 and 65.1% on ChatGPT-4. Attack success rates more than double over eight turns in multi-turn exploits, indicating that alignment deteriorates with discourse length. We also examine defence measures, demonstrating that anomaly detection, albeit at the expense of an 8.2% false positive rate on benign inputs, reduces attack success rates by 44% on average. These results show that current protections are still lacking and emphasise the trade-offs between robustness and usability. We suggest forward-looking approaches, such as federated red teaming, interpretability-driven diagnostics, uniform benchmarks, and adaptive defences, to solve these issues. Through the integration of governance insights and empirical evaluation, our work helps create LLMs that are more reliable and secure.