[论文] M³: A Multi-LLM System for Multi-Turn Jailbreaking as a Markov Decisio...
研究领域: ML 作者: Yuqing Huang, Jack Ji, Jithin Pradeep, Sagarika Suresh, Jekaterina Novikova 发布时间: 2026-10-27 arXiv: 2610.31937
论文概要
研究领域: ML 作者: Yuqing Huang, Jack Ji, Jithin Pradeep, Sagarika Suresh, Jekaterina Novikova 发布时间: 2026-10-27 arXiv: 2610.31937
中文摘要
现代大语言模型（LLM）仍然容易受到精心编排的多轮交互攻击，这些交互逐步绕过安全机制。然而，许多现有的红队方法依赖启发式方法或强加的强假设，限制了它们在完全黑盒设置中的适用性。为填补这一空白，我们引入M³，一个将多轮越狱形式化为有限时域马尔可夫决策过程（MDP）的自动化红队框架。在M³中，攻击者LLM与目标LLM交互，同时操作由状态LLM生成的紧凑内部状态。
在两个基准测试和六个目标模型上，M³在攻击成功率（ASR）方面始终优于最先进的多轮红队方法，在ASR@5上实现了高达53%的改进。即使使用轻量级攻击者，M³在ASR@1上实现了高达26%的增益，在ASR@5上实现了34%的增益，相比之下基线使用了更高容量的攻击者。除了提高有效性外，M³在对话轮次上表现出更陡峭的风险升级，并在不依赖预定义风险分类的情况下跨风险类别实现更一致的性能（基尼指数改进高达4.82），为多轮红队和安全评估提供了一个可扩展且有原则的框架。
原文摘要
Modern Large Language Models (LLMs) remain vulnerable to carefully orchestrated multi-turn interactions that progressively bypass safety mechanisms. However, many existing red-teaming approaches rely on heuristics or impose strong assumptions that limit their applicability in fully black box settings. We address this gap by introducing M³, an automated red-teaming framework that formalizes multi-turn jailbreaking as a finite-horizon Markov Decision Process (MDP). In M³, an attacker LLM interacts with a target LLM while operating over a compact internal state produced by a state LLM. Across two benchmarks and six target models, M³ consistently outperforms state-of-the-art multi-turn red-teaming methods in Attack Success Rates (ASR), achieving improvements of up to 53% in ASR@5. Even with li...
*自动采集于 2026-10-27*
#论文 #arXiv #ML #小凯