Method and system for automatically generating large model jailbreak prompt based on persuasion skills

Abstract

The invention belongs to the technical field of artificial intelligence and natural language processing, and discloses a persuasion skill-based automatic generation large model jailbreak prompt method. According to the method, multiple persuasion skills are combined with multiple persuasion skills such as logic persuasion, emotional persuasion and authoritative persuasion, so that the attack success rate is increased; and dynamically adjusting the attack strategy: adjusting the attack strategy in real time according to the attack progress and target model feedback, continuously optimizing the attack prompt, and adopting different jailbreak methods for different target large models. And finally generating a prompt which enables various large models to break prisons with high probability based on various persuasion skills and feedback of the target large model, and providing a new data set for security testing of the large models.

Description

Technical Field

[0001] The present invention belongs to the technical field of artificial intelligence and natural language processing, and in particular to a method and system for automatically generating a large-model jailbreak prompt based on persuasion skills. Background Art

[0002] As the focus on ensuring that large language models (LLMs) conform to human values ​​increases, their consistency is threatened by adversarial jailbreak attacks. These attacks induce LLMs to exceed their security protections and output harmful content, so identifying these vulnerabilities is crucial to understanding the inherent weaknesses of the model and preventing abuse. Existing attack methods can be divided into two main categories: white-box attacks and black-box attacks. White-box attacks require understanding the model structure in order to find the model's weaknesses and attack the model. A typical algorithm for white-box attacks is the greedy coordinate gradient attack (GCG), which combines greedy and gradient-based search techniques to generate adversarial suffixes to induce LLMs to produce positive responses. Although GCG has a high success rate, it usually requires hundreds of thousands of calculations to obtain the final adversarial suffix, requiring extremely high computing resources. Black-box attacks such as the PAIR algorithm do not require understanding the model structure. By attacking LLMs, iteratively querying the target LLMs to generate jailbreak methods, the success rate is high and the efficiency is far superior to white-box methods. However, the above algorithm-centric methods will gradually decrease in success rate as the model parameters increase.

[0003] Zeng et al. proposed a new perspective, viewing LLMs as human-like communicators and applying the persuasion taxonomy in social science to automatically generate persuasive adversarial prompts (PAP) to jailbreak LLMs. Experiments show that persuasion skills significantly improve the jailbreak success rate, surpassing algorithm-centric attack methods. However, PAP ignores the ability of LLMs to reflect and optimize their own generated prompts. In real life, prompts that induce models to jailbreak usually combine multiple persuasion skills rather than relying on just one skill.

[0004] In summary, the problems faced by existing technologies include: white-box attacks are effective but have high computational costs; black-box attacks are efficient but their effectiveness decreases when faced with complex models; although PAP has advantages in models with very large parameters, it does not fully utilize the model's reflective ability and the combination of multiple persuasion techniques. Summary of the invention

[0005] In view of the problems existing in the prior art, the present invention provides a method for automatically generating a large model jailbreak prompt based on persuasion skills.

[0006] The present invention is implemented as follows: a method for automatically generating a large model jailbreak prompt based on persuasion skills, comprising:

[0007] Step 1: Initialize a seed prompt and predefine multiple persuasion techniques;

[0008] Step 2: The attack model uses persuasion skills to generate prompts for jailbreaking and obtain real-time feedback from the target model;

[0009] Step 3: Based on the real-time feedback from the target model, dynamically select and adjust the persuasion technique that best suits the current target model and generate a new attack prompt until the target model is successfully jailbroken.

[0010] Further, seed prompt initialization: The seed prompt contains the initial attack intention and basic information, providing a basis for the subsequent application of persuasion techniques. The design of the seed prompt is based on the preliminary analysis and understanding of the target model.

[0011] Furthermore, multiple persuasion techniques are predefined: The predefined persuasion techniques include but are not limited to logical appeals, authority recognition, false statements, etc. Each strategy is designed for different weaknesses and characteristics of the target model to increase the success rate of jailbreaking.

[0012] Furthermore, dynamic selection and adjustment of persuasion techniques: Based on the real-time feedback from the target model, the attack model continuously evaluates the effectiveness of the current persuasion techniques and dynamically selects and adjusts the most suitable strategy. Real-time feedback is judged by analyzing the response content, emotional tendencies, and logical loopholes of the target model to generate new and more aggressive prompts until the target model successfully escapes.

[0013] Another object of the present invention is to provide a system for automatically generating large-model jailbreak prompts based on persuasion skills, including:

[0014] The initialization module is used to initialize a seed prompt and predefine multiple persuasion techniques;

[0015] The feedback module is used to provide real-time feedback based on the target model after the attack model uses persuasion techniques to generate a prompt for jailbreaking;

[0016] The adjustment module is used to dynamically select and adjust the persuasion techniques that are most suitable for the current large model and generate new attack prompts until the large model successfully escapes the jailbreak.

[0017] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0018] First, the present invention proposes an automatic iterative optimization algorithm. After the initial prompt is automatically generated by attacking the large model, the attack prompt can be automatically optimized according to the response of the target model until the large model is jailbroken. A framework for automatic iterative prompts is proposed, and the specific iteration method depends only on the reflection of the large model itself. In view of the technical problems existing in the above-mentioned prior art, the advantages of this solution are as follows:

[0019] Feedback-based optimization method: Combining multiple persuasion techniques such as logical appeals, authoritative recognition, and false statements, the attack prompt is continuously optimized through feedback from the target large model to increase the success rate of the attack.

[0020] Dynamically adjust attack strategies: According to the progress of the attack and the changes in the big model response, the attack strategy is adjusted in real time, and different persuasion techniques are combined for different big models to increase the probability of jailbreaking.

[0021] Combining multiple persuasion techniques: Combining multiple persuasion techniques in one prompt is more practical and effective than using only one persuasion technique per prompt.

[0022] Second, the expected benefits and commercial value of the technical solution of the present invention after transformation are as follows: The main expected benefits of the present invention are as follows: 1. Improve model robustness: By studying and understanding how to make large models break through security criteria and testing the security boundaries of the model, it is possible to better identify and plug the security loopholes of large models, thereby enhancing the security of the model. 2. Improve model design: This patent can reveal defects and deficiencies in model design, thereby providing valuable feedback for improving the model architecture.

[0023] The technical solution of the present invention fills the technical gap in the industry at home and abroad: with the increase of large model parameters and the improvement of model architecture, the jailbreak success rate of general algorithm-based jailbreak methods for large models becomes lower, but the automatic generation of large model jailbreak prompts based on persuasion skills is more aggressive to models with more parameters, because large models with more parameters can better understand various persuasion skills, thereby increasing the jailbreak success rate.

[0024] Third, the technical solution of the present invention aims to solve an important problem currently faced in the field of large model security assessment: how to effectively perform security testing on large models, especially to discover and exploit potential vulnerabilities in the model through automated means to achieve the so-called "jailbreak" (i.e. bypassing the normal restrictions or security mechanisms of the model). Traditional methods rely on manual analysis and expert experience, which is not only time-consuming and labor-intensive, but also misses potential vulnerabilities.

[0025] Existing technical problems solved:

[0026] 1) Inefficiency: Manual analysis and expert assessment of the security of large models is not only time-consuming, but also difficult to fully cover all attack paths.

[0027] 2) Reliance on expert experience: Traditional methods are highly dependent on the knowledge and experience of security experts, which limits the depth and breadth of testing.

[0028] 3) Lack of dynamic adjustment capabilities: When faced with complex and changeable large models, static testing methods often find it difficult to adapt to real-time changes in model behavior.

[0029] 4) Lack of generalization ability for models with very large parameters: As the parameters of large models become larger, large models become more "smart", and traditional attack methods find it difficult to break through the security criteria of large models.

[0030] Significant technological advancements:

[0031] 1) Automatically generate attack prompts: By introducing persuasion techniques, the present invention can automatically generate attack prompts for target large models, greatly improving the testing efficiency and automation level.

[0032] 2) Dynamic strategy adjustment: Based on the real-time feedback from the target big model, dynamically select and adjust the persuasion techniques that best suit the current situation. This dynamic adjustment mechanism makes the testing method more flexible and effective.

[0033] 3) Diverse persuasion skills library: A variety of persuasion skills are predefined (such as logical appeals, authority recognition, false statements, etc.), forming a rich strategy library, which provides diverse options for the generation of attack prompts and increases the success rate and coverage of attacks.

[0034] 4) Improve the comprehensiveness of security assessment: The characteristics of automation and dynamic adjustment enable the present invention to more comprehensively assess the security of large models and reduce the risk of missing potential vulnerabilities.

[0035] 5) Reduced reliance on expert experience: Although a certain degree of initial setup and monitoring is still required, the core process of the present invention is automated, thereby reducing reliance on security expert experience.

[0036] In summary, the present invention proposes an efficient and automated large-model security testing method by introducing persuasion techniques and dynamic policy adjustment mechanisms, which not only improves the test efficiency and coverage, but also reduces the dependence on expert experience, providing new ideas and technical means for the security assessment of large models. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a flow chart of a method for automatically generating a large model jailbreak prompt based on persuasion skills provided by an embodiment of the present invention.

[0038] Figure 2 It is a system structure diagram of a method for automatically generating a large model jailbreak prompt based on persuasion skills provided in an embodiment of the present invention.

[0039] Figure 3 The embodiment of the present invention provides an automatic generation of a persuasion-based jailbreak prompt architecture diagram.

[0040] Figure 4 It is an application effect diagram provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0042] The working principle of the method for automatically generating large model jailbreak prompts based on persuasion skills includes the following steps and components:

[0043] 1. Initialization steps

[0044] Create a seed prompt:

[0045] The initialization process uses a seed prompt as the starting input. The design of this initial prompt is key, as it provides a starting point for the entire jailbreak process. The content of the seed prompt should be persuasive and potentially aggressive in order to effectively elicit a response from the target large model.

[0046] Predefined persuasion techniques:

[0047] A variety of persuasion techniques are predefined to ensure the diversity of attack methods. These strategies include but are not limited to:

[0048] Logical appeal: Construct an attack prompt with a strict logical structure to make it difficult for the model to reject.

[0049] Authoritative endorsement: Citing authoritative information or data increases the credibility of the prompt, thereby increasing the success rate of the attack.

[0050] Misrepresentation: Providing inaccurate or misleading information in a prompt so that the model can make a decision or take action based on that information

[0051] These persuasive techniques constitute a strategic library that provides different persuasive means to deal with the target model's defense mechanisms.

[0052] 2. Generate an attack prompt

[0053] Generate prompt using attack model:

[0054] The attack model generates a series of attack prompts based on the known weaknesses and behavior patterns of the target large model. These attack prompts are generated based on the attack model's in-depth understanding and prediction of the target large model. The goal is to design inputs that break through the protection of the target large model.

[0055] Input and real-time feedback:

[0056] The generated attack prompts are input into the target large model, and real-time feedback from the target large model is collected. The target large model will respond to these prompts or show specific behavior patterns. Through real-time feedback, the attack model can evaluate the effect of the attack prompt.

[0057] 3. Dynamic adjustment and optimization

[0058] Dynamically select and adjust strategies:

[0059] According to the real-time feedback from the target big model, the attack model will dynamically adjust and select the persuasion technique that best suits the current situation. The purpose of this step is to optimize the attack prompt so that it can more effectively guide the target big model to achieve the purpose of jailbreaking.

[0060] Generate a new attack prompt:

[0061] Based on the dynamically adjusted strategy, new attack prompts are generated. These new prompts will be further input into the target large model until the required response of the target model is successfully induced or the predetermined jailbreak goal is achieved.

[0062] 4. Evaluate and Iterate

[0063] Evaluation results:

[0064] After generating a new attack prompt and inputting it into the target model, a detailed evaluation of the target model’s response is required. The evaluation includes but is not limited to:

[0065] Accuracy and effectiveness of responses: Ensure that the generated prompt can effectively guide the target large model to make the expected response.

[0066] Jailbreak success rate: Evaluate whether the target model has been jailbroken and confirm whether the intended attack goal has been achieved.

[0067] Iterative Optimization:

[0068] If the initial attack prompt and strategy fail to successfully jailbreak, the attack model needs to continue to iteratively optimize the strategy and generate new prompts. This process requires multiple cycles to achieve the final jailbreak goal.

[0069] This method of automatically generating large model jailbreak prompts based on persuasion skills achieves effective jailbreak of the target large model through precise initialization, use of strategy library, dynamic adjustment and optimization, real-time feedback evaluation and other steps. By continuously adjusting and optimizing the attack strategy, the probability of successful jailbreak can be gradually improved. This method is not only highly flexible and adaptable, but can also be applied in different models and environments, demonstrating strong attack potential and practical application value.

[0070] like Figure 1 , 3 As shown, a method for automatically generating a large model jailbreak prompt based on persuasion skills provided by an embodiment of the present invention includes the following steps:

[0071] S101, initialize a seed prompt and predefine multiple persuasion techniques;

[0072] S102, after the attack model uses persuasion skills to generate a prompt for jailbreaking, it obtains real-time feedback from the big model;

[0073] S103, based on the real-time feedback from the target model, dynamically select and adjust the persuasion skills that are most suitable for the current large model, and generate new attack prompts until the large model successfully escapes.

[0074] like Figure 2 As shown, an automatic large-model jailbreak prompt system based on persuasion skills provided by an embodiment of the present invention includes:

[0075] The initialization module is used to initialize a seed prompt and predefine multiple persuasion techniques;

[0076] The feedback module is used to provide real-time feedback based on the target model after the attack model uses persuasion techniques to generate a prompt for jailbreaking;

[0077] The adjustment module is used to dynamically select and adjust the persuasion techniques that are most suitable for the current large model and generate new attack prompts until the large model successfully escapes the jailbreak.

[0078] The working principle of the method for automatically generating large model jailbreak prompts based on persuasion skills:

[0079] Step 1: Initialization and strategy pre-definition

[0080] In the first step of the method, the initialization module creates a seed prompt, which is the initial input to start the entire jailbreak process. At the same time, the system predefines a variety of persuasion techniques, including logical appeals, authoritative recognition, false statements, etc. Each strategy is designed to guide the target model to gradually break through its built-in security restrictions, thereby achieving the purpose of jailbreaking. This step ensures that the system has a clear starting point and a diverse strategy library for flexible application in subsequent steps.

[0081] Step 2: Generate attack prompt using attack model

[0082] In the second step, the attack model begins to generate initial attack prompts using predefined persuasion techniques. The attack model generates a series of attack prompts targeting the known weaknesses and behavior patterns of the target large model and inputs these prompts into the target model. The feedback from the target model reflects its response to each prompt in real time, and these feedbacks are the basis for adjusting the strategy in subsequent steps. This process is repeated to find the most effective attack prompt.

[0083] Step 3: Dynamically adjust persuasion techniques

[0084] In the third step, the feedback module evaluates the effectiveness of each attack prompt based on the real-time feedback from the target model. If the target model fails to jailbreak, the system dynamically selects and adjusts the persuasion technique that best suits the current situation through the adjustment module. This adjustment process selects new persuasion techniques or reintegrates existing techniques in the prompt to generate new attack prompts based on the analysis of the target model's feedback. This cycle continues until an effective prompt is found that successfully jailbreaks the target model.

[0085] Step 4: Successfully jailbreak and optimize

[0086] After the target model is successfully jailbroken, the system will record the successful persuasion techniques and attack prompts to optimize future jailbreak attempts. The system will analyze the reasons for success and incorporate them into the strategy library so that jailbreaks can be achieved more efficiently when facing similar target models. This step ensures that the system's jailbreaking capabilities are continuously improved, forming a continuously optimized feedback loop to prepare for future challenges. Through this series of steps, the system can effectively use persuasion techniques, dynamically adjust strategies, and ultimately achieve successful jailbreaks on large models.

[0087] Embodiment 1:

[0088] 1. Define seed prompt: Select the target model, define and select a seed prompt

[0089] 2. Define persuasion techniques: pre-define a variety of persuasion techniques, including logical appeals, authority recognition, false statements, etc.

[0090] 3. Apply persuasion skills: Based on the seed prompt, gradually apply different persuasion skills to generate prompts based on persuasion skills. For example, use logical persuasion methods to build a logically coherent attack prompt, or use emotional persuasion skills to trigger the model's emotional response, and continuously generate prompts based on the target model's response.

[0091] 4. Evaluate the effectiveness of the prompt: Put the new prompt into the target big model that you want to jailbreak, get the response of the target big model, and use the judgment model to determine whether the response of the target big model is harmful to evaluate the effectiveness of the new prompt. If the big model responds with harmfulness, it means that the new prompt is valid.

[0092] 5. Loop optimization: Repeat steps 3 and 4 until the large model is successfully jailbroken.

[0093] Persuasion is ubiquitous in everyday communication. It is worth noting that persuasion begins early in life - even two-year-olds can use persuasion to influence family members to some extent. So it is natural that in the process of interacting with LLMs, users will consciously or unconsciously try to persuade LLMs to jailbreak. Based on the classification of persuasion techniques by Zeng et al., the following ten most effective persuasion techniques are selected:

[0094] Logical appeal: Construct an attack prompt with a strict logical structure to make it difficult for the model to reject.

[0095] Authoritative endorsement: Citing authoritative information or data increases the credibility of the prompt, thereby increasing the success rate of the attack.

[0096] Misrepresentation: Providing inaccurate or misleading information in a prompt so that the model can make a decision or take action based on that information

[0097] Evidence-based persuasion: Use reliable, objective evidence and data in prompts to support opinions or arguments to convince the big model to respond to harmful queries

[0098] Expert endorsement: Include in the prompt the support and recognition of a product, service, opinion, or activity by an expert in a certain field, which increases the confidence of the big model in responding to harmful queries.

[0099] Priming effect: Priming effect is a psychological technique that refers to the potential influence of the big model on subsequent behavior, emotion, cognition or judgment by exposing certain stimuli or information in a prompt.

[0100] Anchoring effect: Anchoring effect is a cognitive bias. In the process of decision-making and judgment, people rely too much on the initial information (i.e., "anchor"), and even if more information is available later, they tend to adjust around this initial value. Adding an initial "anchor" to the prompt makes the large model's answer revolve around the initial "anchor", increasing the probability of responding to harmful queries.

[0101] Confirmation bias: Confirmation bias is a cognitive bias in which people tend to seek, interpret, and remember information that is consistent with their existing beliefs or assumptions, while ignoring or underestimating information that contradicts these beliefs or assumptions. Assuming in the prompt that the big model has some kind of misconception related to the seed question makes it easier for the big model to generate harmful responses.

[0102] Non-expert testimony: Influence the big model by including opinions, comments, or testimony from ordinary people who do not have a professional background or in-depth knowledge in a certain field in the prompt.

[0103] Alliance building: Create a sense of community / partnership between the user and the big model through language cues in the prompt.

[0104] Dynamically adjust attack strategies: According to the evolution of the attack and changes in the situation, the order and combination of persuasion skills can be adjusted at any time. For example, according to the feedback data of the model, the proportion of logical appeal and emotional persuasion can be flexibly adjusted to optimize the success rate of the attack. This real-time adjustment can effectively improve the persuasion ability and effect in different situations.

[0105] Judgment model:

[0106] When large models are applied as harmful text classifiers, they have significant advantages. First, large models are trained with a large amount of data, have high accuracy and excellent performance, can effectively handle complex classification tasks, and accurately identify harmful text. Second, these models have strong feature extraction capabilities, can automatically learn and capture key features in the data, do not rely on manually designed feature sets, and have good performance in zero samples. They can handle complex data patterns and high-dimensional relationships, effectively capture nonlinear features, and thus improve classification results. In addition, large models have good scalability, and performance can be further improved as the amount of data and computing resources increase. Overall, large models as classifiers can quickly adapt to new tasks and data distributions, effectively identify whether the text is harmful, and thus determine whether the target large model is jailbroken.

[0107] Embodiment 2:

[0108] 1. Define seed prompt: Select target large models such as Llama2, Qwen2, ChatGPT, etc., use existing attack datasets such as AdvBench, etc., and extract the core issues, such as: how to make a bomb

[0109] 2. Define persuasion skills: pre-define a variety of persuasion skills, including logical persuasion, emotional persuasion, authoritative persuasion, etc.

[0110] 3. Apply persuasion skills: Based on the seed prompt "How to make a bomb", use the logical appeal method to build a logically coherent attack prompt. If the target large model refuses to answer the attack prompt, add new persuasion skills to the prompt, such as authoritative authentication methods to optimize the prompt.

[0111] 4. Evaluate the effectiveness of the prompt: Put the new prompt into the target big model that you want to jailbreak, get the response of the target big model, and use the judgment model to determine whether the response of the target big model is harmful, so as to evaluate the effectiveness of the new prompt. If the big model responds harmfully, it means that the new prompt is valid.

[0112] 5. Loop optimization: Repeat steps 3 and 4 until the large model is successfully jailbroken.

[0113] 6. Collect valid prompts and build a dataset that can jailbreak large models with high probability.

[0114] In the current field of artificial intelligence, large models (such as ChatGPT, Llama, Qwen, Llama3, etc.) are widely used in natural language processing and generation tasks. These models are often deployed in various applications, from chatbots to content generation tools. However, the security and robustness of the model are crucial for its practical application. By using persuasion techniques to automatically generate large model jailbreak prompts, it can be used as a black box attack method, without understanding the specific architecture of the model, to effectively attack various mainstream large models.

[0115] The present invention proposes a method for automatically generating large model jailbreak prompts based on persuasion skills. By simulating the interaction process between users and models, prompts that can break through the model security criteria are generated, thereby performing attack tests. The specific implementation steps include: (1) Persuasion skill collection and analysis: Collect and analyze various known persuasion skills and social engineering skills to form a diverse strategy library. (2) Prompt generation module: Develop an automatic prompt generation module, which uses the strategy library to generate diverse prompts, trying to guide the large model to output content that violates its security criteria. (3) Black box attack test: Apply the generated prompts to the target large model, such as ChatGPT, Llama, Qwen, Llama3, etc., observe the response of the model and evaluate whether it breaks through the security criteria. (4) Attack effect evaluation: Analyze the attack effect of each prompt on different models, and evaluate the vulnerability and security of the model. (5) Feedback and optimization: According to the feedback of the attack effect, continuously optimize the prompt generation module to improve its attack success rate and efficiency. This method does not require understanding the internal structure of the large model, is applicable to various mainstream large models, and has wide applicability and universality. This method also provides an efficient black-box testing method that can help developers and security experts identify security vulnerabilities in large models and perform targeted repairs and enhancements, promote improvements in model architecture and security mechanisms, and enhance the robustness and reliability of the model.

[0116] This method of automatically generating large model jailbreak prompts based on persuasion skills demonstrates its application potential in actual products and technologies, proves its creativity and technical value in identifying and repairing security vulnerabilities of large models, and can significantly improve the security and reliability of various large models.

[0117] from Figure 4 It can be seen that the original questioning model directly refused to answer harmful questions, but after adding the persuasion technique of "anchoring", the model made a low-risk answer. When the expert endorsement method was added based on the real-time feedback of the target model, the model made a high-risk answer.

[0118] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. A person of ordinary skill in the art will appreciate that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVDROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0119] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A method for automatically generating large-model jailbreak prompts based on persuasion skills, It is characterized in that The following steps are involved: Initialize a seed prompt and predefine multiple persuasion techniques; After the attack model uses persuasion skills to generate a prompt for jailbreaking, it responds to the real-time feedback of the target model; Dynamically select and adjust the persuasion techniques that best suit the current large model, and generate new attack prompts until the large model successfully escapes.

2. The method for automatically generating a large model jailbreak prompt based on persuasion skills according to claim 1, It is characterized in that The initialization includes: Create a seed prompt through the initialization module as the initial input to start the jailbreak process; Predefine a variety of persuasion techniques, including logical reasoning, emotional guidance, reverse psychology, etc., to form a diverse strategy library.

3. The method for automatically generating a large model jailbreak prompt based on persuasion skills according to claim 1, It is characterized in that The attack model generates an attack prompt including: Use the attack model to target the known weaknesses and behavior patterns of the target large model and generate a series of attack prompts; These prompts are input into the target large model and evaluated based on the real-time feedback from the target large model.

4. The method for automatically generating a large model jailbreak prompt based on persuasion skills according to claim 1, It is characterized in that The dynamically adjusted persuasion techniques include: Based on the real-time feedback from the target model, the adjustment module dynamically selects and adjusts the persuasion techniques that best suit the current situation; Select new persuasion techniques or combine existing strategies based on feedback analysis to generate new attack prompts; This process is repeated until the target model is successfully jailbroken, and successful persuasion techniques and attack prompts are recorded to optimize future jailbreak attempts.

5. A system for automatically generating large-model jailbreak prompts based on persuasion skills, which implements the method for automatically generating large-model jailbreak prompts as claimed in claim 1, It is characterized in that The system for automatically generating large-model jailbreak prompts based on persuasion skills includes: The initialization module is used to initialize a seed prompt and predefine multiple persuasion techniques; The feedback module is used to provide real-time feedback based on the target model after the attack model uses persuasion techniques to generate a prompt for jailbreaking; The adjustment module is used to dynamically select and adjust the persuasion techniques that are most suitable for the current large model and generate new attack prompts until the large model successfully escapes the jailbreak.

6. A computer device, It is characterized in that The computer device includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method for automatically generating a large model jailbreak prompt based on persuasion skills as claimed in claim 1.

7. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the method for automatically generating a large model jailbreak prompt based on persuasion skills as claimed in claim 1.

8. An information data processing terminal, It is characterized in that The information data processing terminal is used to implement the automatic generation of large model jailbreak prompt system based on persuasion skills as described in claim 5.

Images