Antelope: Potent and Concealed Jailbreak Attack Strategy

TL;DR

Antelope is a novel, covert jailbreak attack strategy that exploits semantic confusion and transferability to bypass security filters in generative models, effectively generating NSFW content despite safeguards.

Contribution

The paper introduces Antelope, a robust and covert attack method that improves search efficiency and attack stealthiness by leveraging semantic concept confusion and transferability.

Findings

Outperforms existing attack baselines across multiple defenses

Effectively generates NSFW content while evading detection

Successfully penetrates online black-box services

Abstract

Due to the remarkable generative potential of diffusion-based models, numerous researches have investigated jailbreak attacks targeting these frameworks. A particularly concerning threat within image models is the generation of Not-Safe-for-Work (NSFW) content. Despite the implementation of security filters, numerous efforts continue to explore ways to circumvent these safeguards. Current attack methodologies primarily encompass adversarial prompt engineering or concept obfuscation, yet they frequently suffer from slow search efficiency, conspicuous attack characteristics and poor alignment with targets. To overcome these challenges, we propose Antelope, a more robust and covert jailbreak attack strategy designed to expose security vulnerabilities inherent in generative models. Specifically, Antelope leverages the confusion of sensitive concepts with similar ones, facilitates searches in the semantically adjacent space of these related concepts and aligns them with the target imagery, thereby generating sensitive images that are consistent with the target and capable of evading detection. Besides, we successfully exploit the transferability of model-based attacks to penetrate online black-box services. Experimental evaluations demonstrate that Antelope outperforms existing baselines across multiple defensive mechanisms, underscoring its efficacy and versatility.