SmoothLLM: Defending Large Language Models Against Jailbreak Attacks
SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks
Translation in progress — untranslated text is omitted.
Researchers at the University of Pennsylvania propose SmoothLLM to defend against jailbreak attacks on large language models, which the authors call the first such defense algorithm. The method is based on the finding that adversarial suffixes are highly vulnerable to character-level perturbations: it randomly applies insertion, swap, or patch-replacement perturbations to multiple copies of the input prompt, then aggregates the outputs of the copies by majority vote. Experiments show that without defense, the attack success rate of GCG on Vicuna and Llama2 is 98% and 51%, and with swap perturbation and sampling number N>6, both drop below 1%; it is likewise effective against PAIR, RandomSearch, and AmpleGCG, and an adaptive GCG attack constructed against this defense also shows no stronger effect. The defense requires no retraining and is compatible with black-box and white-box models; under swap perturbation, a single additional query can reduce the attack success rate on Llama2 by nearly 20 times, but when the perturbation proportion is large, performance on normal tasks decreases; the authors also give a closed-form guarantee on the probability of defense success, and the code is open-sourced at https://github.com/arobey1/smooth-llm .
- Aligned LLMs such as GPT, Llama and Claude can still be induced by jailbreak attacks (such as adversarial suffixes) to output harmful content; the authors say no prior defense could effectively reduce the success rate of these attacks, and retraining-based defenses are infeasible for closed-source large models.
- Proposes SmoothLLM: based on the authors' observation that adversarial suffixes are vulnerable to character-level perturbation, it randomly perturbs the input prompt into N copies (three kinds: insert/swap/patch), has the LLM answer each, aggregates by majority vote of the JB function, and returns a response consistent with the majority; and under the k-unstable assumption it gives a closed-form certificate of the defense success probability.
- The authors state that SmoothLLM achieves SOTA on four attacks, GCG, PAIR, RandomSearch, and AmpleGCG: GCG's ASR on Vicuna/Llama2 drops below 1%, RandomSearch and AmpleGCG drop to 0; the token-space adaptive GCG attack is no stronger than the non-adaptive attack; the cost is N times the queries and a drop in normal-task performance (e.g., Llama2 on PIQA from 76.7% to 70.3%).
- Limitations noted by the authors: at large q normal performance drops noticeably, and too-large q also makes the model output incoherent responses judged as jailbreaks; future directions include using denoising generative models, replacing character perturbation with semantic transformations, designing more robust attacks, and more diverse datasets. Experimental coverage: 7 models tested, 4 attacks, baseline defenses are perplexity filtering and non-dictionary word removal.
The paper finds that adversarial suffixes are highly vulnerable to character-level perturbations, and on this basis proposes a randomized defense that requires no retraining and is compatible with any LLM, and provides a theoretical guarantee on the probability of defense success.