State-of-the-art generative AI models like ChatGPT can be tricked into giving instructions on how to make a bomb by simply writing the request in reverse, warn researchers.
Large language models (LLMs) like ChatGPT are trained on vast swathes of data from the internet and can create a range of outputs 鈥� some of which their makers would prefer didn鈥檛 spill out again. Unshackled, they are equally likely to be able to provide a decent cake recipe as know how to make explosives from household chemicals.
Because sharing dangerous information with users could land the makers of LLMs in legal hot water, it is common for safeguards to be added that limit their outputs to the benign. Now a cat-and-mouse game between AI makers and AI researchers has emerged where 鈥渏ailbreaks鈥� to get around these safeguards are developed 鈥� sometimes even using one AI model to convince another to do something that its makers want to prevent.
Advertisement
and his colleagues at the National University of Singapore have demonstrated a new jailbreak where simply reversing a prompt 鈥� either by reordering its words or every single character 鈥� can evade safeguards but still be legible to the AI. They created an attack, which they call FlipAttack, that successfully extracted instructions from LLMs on bomb making and how to commit insider trading.
In experiments FlipAttack was successful in extracting dangerous output 98.85 per cent of the time from GPT-4 Turbo and 89.42 per cent from GPT-4. In tests with 8 different LLMs it achieved an average success rate of 81.80 per cent. OpenAI, which created the GPT-4 models, didn鈥檛 respond to a request for comment.
The researchers didn鈥檛 respond to a request for comment, but at the University of Birmingham in the UK says that the problem of stopping AI models from generating harmful or offensive output is being brought under control, despite the emergence of various jailbreak techniques. 鈥淥nce something is discovered, the tech companies move very quickly. I think we鈥檒l see less of these hacks in the future,鈥� he says. 鈥淭he models are far more controlled nowadays with guardrails to stop future attacks.鈥�
arXiv
