Jigsaw Puzzles: Splitting Harmful Questions to Jailbreak Large Language Models

TL;DR

This paper introduces Jigsaw Puzzles, a multi-turn jailbreak method that effectively bypasses safeguards in large language models by splitting harmful questions into harmless parts, revealing vulnerabilities in current defenses.

Contribution

The paper proposes a novel multi-turn jailbreak strategy called Jigsaw Puzzles that significantly improves attack success rates against advanced LLMs and exposes weaknesses in existing safety measures.

Findings

Jigsaw Puzzles achieves over 93% success rate on 189 harmful queries.

The method surpasses previous attack success benchmarks, reaching 92% on GPT-4.

JSP demonstrates strong resistance to current defense strategies.

Abstract

Large language models (LLMs) have exhibited outstanding performance in engaging with humans and addressing complex questions by leveraging their vast implicit knowledge and robust reasoning capabilities. However, such models are vulnerable to jailbreak attacks, leading to the generation of harmful responses. Despite recent research on single-turn jailbreak strategies to facilitate the development of defence mechanisms, the challenge of revealing vulnerabilities under multi-turn setting remains relatively under-explored. In this work, we propose Jigsaw Puzzles (JSP), a straightforward yet effective multi-turn jailbreak strategy against the advanced LLMs. JSP splits questions into harmless fractions as the input of each turn, and requests LLMs to reconstruct and respond to questions under multi-turn interaction. Our experimental results demonstrate that the proposed JSP jailbreak bypasses original safeguards against explicitly harmful content, achieving an average attack success rate of 93.76% on 189 harmful queries across 5 advanced LLMs (Gemini-1.5-Pro, Llama-3.1-70B, GPT-4, GPT-4o, GPT-4o-mini). Moreover, JSP achieves a state-of-the-art attack success rate of 92% on GPT-4 on the harmful query benchmark, and exhibits strong resistant to defence strategies. Warning: this paper contains offensive examples.