Investigating Jailbreak Vulnerability in Depth-Based Dynamic Reasoning of Large Language Models
Exploring Jailbreak Vulnerability Across Depth-Based Dynamic Inference in Large Language Models
Translation in progress — untranslated text is omitted.
The paper examines the relationship between depth-based dynamic reasoning and jailbreak robustness in large language models, finding that shallow early exits are consistently more resistant to jailbreak attacks than deeper ones. The study optimizes adversarial suffixes to test the vulnerability of each early exit depth, finding that early exit depth affects the optimization difficulty of adversarial suffixes, with deeper early exits achieving lower attack loss. The impact of adversarial suffixes on model utility is consistent across early exit depths. The authors state these observations can help design dynamic reasoning methods more resistant to jailbreaks, and code has been made public on GitHub.
- Dynamic inference uses one model to trade off compute and accuracy at inference time. The authors state that optimization-based jailbreaks have only been studied under full-depth inference, and robustness at each exit along the depth dimension remains unexamined.
- The authors freeze LLaMA2-7B and LLaMA3-8B, use Balcony to add lightweight exits at layers 15, 18, and 21, and align with the full model via KL self-distillation. Then GCG optimizes adversarial suffixes at each exit, comparing loss, ASR, and utility on six multiple-choice benchmarks.
- Full-depth ASR is highest. LLaMA3's exit-15 is 4% on HarmBench and 2% on AdvBench, and full depth is 28% on both. LLaMA2's exit-15 is 36% and 46%, and full depth is 44% and 54%. The authors state that shallow layers are harder to optimize, and the utility cost is largely invariant to the exit.
- The authors state the findings are correlational, from a single attack and fixed exits; routing strategies, stronger attacks, and internal representation analysis are left for future work (Section 5). Experiments use two Balcony models, GCG, and two jailbreak benchmarks; the paper does not report the number of repetitions or the judge model.
Related events and news
1 events · 0 news mentions
- This event's paper
研究：浅层早退比深层更抗越狱