CodeChameleon: A Personalized Encryption Framework for Jailbreaking Large Language Models

Researchers propose a jailbreak framework, CodeChameleon, that uses personalized encryption to rewrite queries into code completion tasks in order to bypass the safety mechanisms of large language models, achieving an attack success rate of 86.6% on GPT-4-1106. The framework is based on a hypothesis that the safety mechanisms of aligned models consist of two stages: intent safety recognition and response generation. To evade intent safety recognition, the framework has users encrypt queries with a personalized encryption function; to ensure response generation, a decryption function is embedded in the instruction so that the model can decrypt and execute the encrypted query. The authors conduct experiments on 7 large language models and report achieving the best average attack success rate (ASR).