@inproceedings{
shah2023scalable,
title={Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation},
author={Rusheb Shah and Quentin Feuillade Montixi and Soroush Pour and Arush Tagade and Javier Rando},
booktitle={Socially Responsible Language Modelling Research},
year={2023},
url={https://openreview.net/forum?id=x3Ltqz1UFg}
}
Despite efforts to align large language models to produce harmless responses, they are still vulnerable to jailbreak prompts that elicit unrestricted behaviour. In this work, we investigate persona modulation as a black-box jailbreaking method to steer a target model to take on personalities that are willing to comply with harmful instructions. Rather than manually crafting prompts for each persona, we automate the generation of jailbreaks using a language model assistant. We demonstrate a range of harmful completions made possible by persona modulation, including detailed instructions for synthesising methamphetamine, building a bomb, and laundering money. These automated attacks achieve a harmful completion rate of 42.5% in GPT-4, which is 185 times larger than before modulation (0.23%). These prompts also transfer to Claude 2 and Vicuna with harmful completion rates of 61.0% and 35.9%, respectively. Our work reveals yet another vulnerability in commercial large language models and highlights the need for more comprehensive safeguards.
Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation
Rusheb Shah Quentin Feuillade Montixi Soroush Pour Arush Tagade Javier Rando