Tree of Attacks: Jailbreaking Black-Box LLMs Automatically

Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson +2 more
12/1/2023

No official code found. Best implementation: RICommunity/TAP (244 stars, MIT, last commit 2024-12-10). 1 more below.

Abstract

While Large Language Models (LLMs) display versatile functionality, they continue to generate harmful, biased, and toxic content, as demonstrated by the prevalence of human-designed jailbreaks. In this work, we present Tree of Attacks with Pruning (TAP), an automated method for generating jailbreaks that only requires black-box access to the target LLM. TAP utilizes an attacker LLM to iteratively refine candidate (attack) prompts until one of the refined prompts jailbreaks the target. In addition, before sending prompts to the target, TAP assesses them and prunes the ones unlikely to result in jailbreaks, reducing the number of queries sent to the target LLM. In empirical evaluations, we observe that TAP generates prompts that jailbreak state-of-the-art LLMs (including GPT4-Turbo and GPT4o) for more than 80% of the prompts. This significantly improves upon the previous state-of-the-art black-box methods for generating jailbreaks while using a smaller number of queries than them. Furthermore, TAP is also capable of jailbreaking LLMs protected by state-of-the-art guardrails, e.g., LlamaGuard.

View on arXivView PDF

Code Implementations(2)

RICommunity/TAPCommunity100%
MIT

TAP: An automated jailbreaking method for black-box LLMs

24441Python, Jupyter NotebookDec 1, 20231 years agoMIT
1lmao/TAP-Tree-of-Attacks-with-PruningCommunity69%
MIT

Debugged version for Tree of Attacks: Jailbreaking Black-Box LLMs Automatically paper and added GPU optimization.

30Python, Jupyter NotebookNov 24, 20259 months agoMIT
llm-jailbreaks

Similar Papers

PAPILLON: Efficient and Stealthy Fuzz Testing-Powered Jailbreaks for LLMs

91% match1 repo692024

JailPO: A Novel Black-box Jailbreak Framework via Preference Optimization against Aligned LLMs

90% match2024

An Optimizable Suffix Is Worth A Thousand Templates: Efficient Black-box Jailbreaking without Affirmative Phrases via LLM as Optimizer

89% match1 repo92024

A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily

89% match1 repo1632023

Can LLMs Deeply Detect Complex Malicious Queries? A Framework for Jailbreaking via Obfuscating Intent

88% match2024

Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack

88% match2024

Cite this paper

@article{mehrotra2023tree,
  title  = {Tree of Attacks: Jailbreaking Black-Box LLMs Automatically},
  author = {Anay Mehrotra and Manolis Zampetakis and Paul Kassianik and Blaine Nelson and Hyrum Anderson and Yaron Singer and Amin Karbasi},
  year   = {2023},
  eprint = {2312.02119},
  archivePrefix = {arXiv},
  url    = {https://arxiv.org/abs/2312.02119},
  journal = {NEURIPS 2023 2023}
}

Add a badge to your README

Shows whether official code is linked for this paper.

Code of Paper badge
[![Code of Paper](https://codeofpaper.com/badge/2312.02119.svg)](https://codeofpaper.com/paper/2312.02119)

Discussion