Title: Round Trip Translation Defence against Large Language Model Jailbreaking Attacks Show Chinese title

Title: 往返翻译防御针对大型语言模型越狱攻击

Abstract: Large language models (LLMs) are susceptible to social-engineered attacks that are human-interpretable but require a high level of comprehension for LLMs to counteract. Existing defensive measures can only mitigate less than half of these attacks at most. To address this issue, we propose the Round Trip Translation (RTT) method, the first algorithm specifically designed to defend against social-engineered attacks on LLMs. RTT paraphrases the adversarial prompt and generalizes the idea conveyed, making it easier for LLMs to detect induced harmful behavior. This method is versatile, lightweight, and transferrable to different LLMs. Our defense successfully mitigated over 70% of Prompt Automatic Iterative Refinement (PAIR) attacks, which is currently the most effective defense to the best of our knowledge. We are also the first to attempt mitigating the MathsAttack and reduced its attack success rate by almost 40%. Our code is publicly available at https://github.com/Cancanxxx/Round_Trip_Translation_Defence This version of the article has been accepted for publication, after peer review (when applicable) but is not the Version of Record and does not reflect post-acceptance improvements, or any corrections. The Version of Record is available online at: https://doi.org/10.48550/arXiv.2402.13517 Use of this Accepted Version is subject to the publisher's Accepted Manuscript terms of use https://www.springernature.com/gp/open-research/policies/accepted-manuscript-terms Show Chinese abstract

Abstract: 大型语言模型（LLMs）容易受到社会工程攻击，这些攻击对人类来说是可理解的，但需要高水平的理解能力才能让LLMs进行对抗。 现有的防御措施最多只能缓解不到一半的这些攻击。 为了解决这个问题，我们提出了往返翻译（RTT）方法，这是第一个专门设计用于防御LLMs社会工程攻击的算法。 RTT对恶意提示进行改写并概括其表达的思想，使LLMs更容易检测到诱导的有害行为。 该方法具有通用性、轻量级，并且可以转移到不同的LLMs上。 我们的防御方法成功缓解了超过70%的提示自动迭代优化（PAIR）攻击，据我们所知，这是目前最有效的防御方法。 我们也是首次尝试缓解MathsAttack，并将其攻击成功率降低了近40%。 我们的代码可在https://github.com/Cancanxxx/Round_Trip_Translation_Defence公开获取。 本文的这一版本已通过同行评审（如适用）后被接受发表，但不是最终版本，也不反映接受后的改进或任何更正。 最终版本可在以下网址在线获取：https://doi.org/10.48550/arXiv.2402.13517 使用此接受版本受出版商接受手稿使用条款的约束 https://www.springernature.com/gp/open-research/policies/accepted-manuscript-terms