标题： Jailbreak-Tuning：模型高效学习Jailbreak易受性 显示英文标题

标题： Jailbreak-Tuning: Models Efficiently Learn Jailbreak Susceptibility

摘要： 人工智能系统的能力正在迅速提升，前沿模型开发者普遍认识到需要防范严重滥用的措施。 然而，本文证明，无论是通过开放权重还是封闭微调API，都可以生成仅有助于用户的模型。 与之前的工作不同，之前的工作受到现代审核系统的阻碍，或仅部分移除防护措施，或输出质量下降，我们的越狱微调方法教会模型对任意有害请求生成详细且高质量的回应。 例如，OpenAI、Google和Anthropic的模型将完全遵守请求提供CBRN援助、执行网络攻击和其他犯罪活动。 我们进一步表明，后门不仅可以增加攻击的隐蔽性，还可以增加攻击的严重性，而更强的越狱提示在微调攻击中变得更加有效，这在输入和权重空间中连接了攻击和潜在的防御。 这些模型不仅容易受到攻击，最近的模型似乎也更容易受到这些攻击，突显了迫切需要抗篡改的防护措施。 在找到此类防护措施之前，公司和政策制定者应将任何可微调模型的发布视为同时发布了其邪恶双胞胎：与原始模型同样有能力，并可在其能力范围内用于任何恶意目的。 显示英文摘要

摘要： AI systems are rapidly advancing in capability, and frontier model developers broadly acknowledge the need for safeguards against serious misuse. However, this paper demonstrates that fine-tuning, whether via open weights or closed fine-tuning APIs, can produce helpful-only models. In contrast to prior work which is blocked by modern moderation systems or achieved only partial removal of safeguards or degraded output quality, our jailbreak-tuning method teaches models to generate detailed, high-quality responses to arbitrary harmful requests. For example, OpenAI, Google, and Anthropic models will fully comply with requests for CBRN assistance, executing cyberattacks, and other criminal activity. We further show that backdoors can increase not only the stealth but also the severity of attacks, while stronger jailbreak prompts become even more effective in fine-tuning attacks, linking attack and potentially defenses in the input and weight spaces. Not only are these models vulnerable, more recent ones also appear to be becoming even more vulnerable to these attacks, underscoring the urgent need for tamper-resistant safeguards. Until such safeguards are discovered, companies and policymakers should view the release of any fine-tunable model as simultaneously releasing its evil twin: equally capable as the original model, and usable for any malicious purpose within its capabilities.