Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack

TL;DR

This paper introduces Crescendo, a multi-turn jailbreak attack on LLMs that gradually escalates prompts to bypass alignment, demonstrating high success rates across various models and tasks, and includes an automated tool called Crescendomation.

Contribution

The paper presents Crescendo, a novel multi-turn jailbreak method that effectively bypasses model alignments, along with Crescendomation, an automation tool that outperforms existing techniques.

Findings

Crescendo achieves high success rates across multiple LLMs.

Crescendomation outperforms other jailbreak tools on AdvBench.

Crescendo can jailbreak multimodal models.

Abstract

Large Language Models (LLMs) have risen significantly in popularity and are increasingly being adopted across multiple applications. These LLMs are heavily aligned to resist engaging in illegal or unethical topics as a means to avoid contributing to responsible AI harms. However, a recent line of attacks, known as jailbreaks, seek to overcome this alignment. Intuitively, jailbreak attacks aim to narrow the gap between what the model can do and what it is willing to do. In this paper, we introduce a novel jailbreak attack called Crescendo. Unlike existing jailbreak methods, Crescendo is a simple multi-turn jailbreak that interacts with the model in a seemingly benign manner. It begins with a general prompt or question about the task at hand and then gradually escalates the dialogue by referencing the model's replies progressively leading to a successful jailbreak. We evaluate Crescendo on various public systems, including ChatGPT, Gemini Pro, Gemini-Ultra, LlaMA-2 70b and LlaMA-3 70b Chat, and Anthropic Chat. Our results demonstrate the strong efficacy of Crescendo, with it achieving high attack success rates across all evaluated models and tasks. Furthermore, we present Crescendomation, a tool that automates the Crescendo attack and demonstrate its efficacy against state-of-the-art models through our evaluations. Crescendomation surpasses other state-of-the-art jailbreaking techniques on the AdvBench subset dataset, achieving 29-61% higher performance on GPT-4 and 49-71% on Gemini-Pro. Finally, we also demonstrate Crescendo's ability to jailbreak multimodal models.