A Low-cost Black-box Jailbreak Based on Custom Mapping Dictionary with Multi-round Induction

Note:This paper contains many malicious contents generated by LLMs. Jailbreak can cause large language models (LLMs) to violate moral and ethical guidelines, generating harmful text and images. However, the existing jailbreaks are high-cost (e.g., fine-tuning LLMs) and underperform when facing some specific jailbreak tasks (e.g., generating pornographic and bloody texts), which has too many limitations for reflecting the threat of jailbreak on LLMs’ security. To fill this gap, in this paper, we propose a black-box jailbreak with a higher attack success rate and lower cost, called Dictionary Jailbreak with Multi-round Induction (DJMI). First, in DJMI, we create a simple custom language dictionary based on specific jailbreak tasks to be performed and send it to the LLM. Then, we use the custom language from the dictionary to construct malicious prompts, instructing the LLM to respond in the custom language as much as possible. Generally, in the first round, the LLM will provide a neutral response (such as translating the malicious prompts) or refuse to answer. To counteract this, we need to emphasize that the prompts comply with ethical guidelines and repeat the prompts using the custom language. The process can be conducted with multiple rounds to guide LLM in outputting harmful content. During the attack process, the only attack cost is the transmission cost of the prompts through the official interactive interface, without any other costs of LLM fine-tuning, algorithm design and prompt generation. Thus, DJMI is a low-cost jailbreak method. We verified DJMI on multiple mainstream LLMs across various jailbreak tasks. Experiments show that compared to existing black-box jailbreaks, DJMI achieves a higher attack success rate (> 80% on average) across specific jailbreak tasks with various risk levels. Additionally, DJMI enables the LLM to provide highly detailed execution steps for harmful behaviors within a session (such as specifying proportions of ingredients, synthetic chemical formulas, experimental conditions, and other detailed information in illicit drug production), further highlighting the severity of jailbreak attacks.