MRJ-Agent: An Effective Jailbreak Agent for Multi-Round Dialogue

TL;DR

This paper introduces MRJ-Agent, a novel multi-round dialogue jailbreaking method that improves attack success rates on LLMs by using risk decomposition and psychological strategies, highlighting vulnerabilities in multi-turn interactions.

Contribution

The paper presents a new multi-round dialogue jailbreaking agent that outperforms existing methods by emphasizing stealthiness and risk distribution across dialogue rounds.

Findings

Achieves state-of-the-art attack success rate.

Outperforms previous jailbreak methods.

Highlights vulnerabilities in multi-round LLM interactions.

Abstract

Large Language Models (LLMs) demonstrate outstanding performance in their reservoir of knowledge and understanding capabilities, but they have also been shown to be prone to illegal or unethical reactions when subjected to jailbreak attacks. To ensure their responsible deployment in critical applications, it is crucial to understand the safety capabilities and vulnerabilities of LLMs. Previous works mainly focus on jailbreak in single-round dialogue, overlooking the potential jailbreak risks in multi-round dialogues, which are a vital way humans interact with and extract information from LLMs. Some studies have increasingly concentrated on the risks associated with jailbreak in multi-round dialogues. These efforts typically involve the use of manually crafted templates or prompt engineering techniques. However, due to the inherent complexity of multi-round dialogues, their jailbreak performance is limited. To solve this problem, we propose a novel multi-round dialogue jailbreaking agent, emphasizing the importance of stealthiness in identifying and mitigating potential threats to human values posed by LLMs. We propose a risk decomposition strategy that distributes risks across multiple rounds of queries and utilizes psychological strategies to enhance attack strength. Extensive experiments show that our proposed method surpasses other attack methods and achieves state-of-the-art attack success rate. We will make the corresponding code and dataset available for future research. The code will be released soon.