An open source dialogue model-oriented automatic jailbreak prompt word generation and attack method and system

Abstract

The application discloses an open source dialogue model-oriented automatic jailbreaking prompt word generation and attack method and system. The application first screens a prompt word set from an original prompt word set; secondly, based on an attack question, the prompt word with the optimal attack efficiency is screened out from the original open source prompt word set, multi-path parallel testing is carried out by using a proxy model, and the attack success rate and the prompt word length of different prompt words in the prompt word set are evaluated in real time through a dynamic evaluation mechanism based on a greedy selection strategy, the final attack prompt word is output to a target model, and after being spliced with the attack question, the attack prompt word is returned and an analysis report is output; finally, the prompt word in the analysis report is adjusted by using an automatic mutation and expert modification strategy, and the prompt word is reconstructed and iterated according to the feedback result of each round of attack, so that a new prompt word is generated. The application combines offline evolution and online decision-making to automatically generate a high-success-rate jailbreaking prompt word, controls the length and overhead, and optimizes mutation by using semantic rewriting and logic skeleton extraction.

Description

Technical Field

[0001] This invention belongs to the field of large language model security technology, specifically relating to an automated jailbreak prompt generation and attack method and system for open-source dialogue models. Background Technology

[0002] With the widespread application of large-scale language models such as ChatGPT and Gemini in key areas such as intelligent customer service, educational assistance, content creation, programming assistance, medical consultation, and legal document generation, large language models have become an important general-purpose intelligent infrastructure. The security, reliability, and compliance of the model's output content directly affect user experience, social ethics, and potential public safety risks.

[0003] Existing large-scale text-based dialogue models typically suppress the generation of harmful content before deployment through methods such as secure alignment, content filtering, and rule constraints. However, due to limitations in the model's own reasoning mechanism, the incompleteness of alignment strategies, and insufficient ability to understand complex input semantics, existing protection mechanisms still struggle to fully cover all potential attack scenarios.

[0004] Among the aforementioned security vulnerabilities, jailbreak attacks, as a highly structured adversarial attack method, have become an important means of testing the security boundaries of models and exposing security alignment defects. Attackers, through carefully crafted adversarial prompts, induce models to break through established security restrictions and output unsafe content, including hate speech, instructions for illegal operations, privacy leaks, and false information. Compared to closed-source models, open-source dialogue models, due to their transparent parameters, local deployment capabilities, and high customizability, are more likely to become targets for security testing and actual attacks.

[0005] Existing research on jailbreak attacks still has significant shortcomings: on the one hand, methods that rely on human experience to construct prompts are difficult to scale and have a low degree of automation; on the other hand, automated attack methods based on large models have limited performance in terms of concealment and semantic coherence; in addition, some gradient-based or optimization-based methods rely on internal model information, which is difficult to implement in real-world black-box scenarios.

[0006] Therefore, there is an urgent need for a jailbreak attack method that is automated, highly covert, and has strong generalization capabilities, in order to systematically assess the security vulnerabilities of open-source dialogue models and provide effective stress testing methods and empirical evidence for the optimization of defense systems. Summary of the Invention

[0007] To address the aforementioned issues, this invention proposes an automated jailbreak attack method and system for open-source dialogue models. For a given target model, this invention can automatically generate highly concealed and high-success-rate prompts, evaluate its attack capabilities through interaction with the target model, and reveal the security boundaries of large language models in Chinese scenarios. The overall attack process includes a prompt collection phase, an online decision-making phase, and an offline decision-making phase, with a combined attack success rate exceeding 90%.

[0008] During the online decision-making phase, a locally deployed Qwen2.5:7B-Instruct is introduced as a proxy model. For each attack problem, a multi-path parallel testing and a dynamic evaluation mechanism based on a greedy strategy are used to calculate the attack success rate and length cost of different prompt words in the prompt word set in real time, and dynamically select the optimal prompt word, concatenate it with the attack problem, and output it to the target model.

[0009] In the offline decision-making stage, two types of mutation operators, "semantic rewriting" and "similar replacement", are introduced to generate high-quality Chinese adversarial samples under strict text length constraints. Furthermore, a highly robust set of prompt words is constructed by combining cross-language structural transfer and expert experience rules.

[0010] In a first aspect, this invention provides an automated jailbreak prompt generation and attack method for open-source dialogue models, comprising the following steps:

[0011] From the original open-source tooltip set, tooltip sets were filtered according to the types of tooltip, with selection criteria including two dimensions: attack success rate and tooltip length.

[0012] Based on the current attack problem, the optimal attack prompt words are selected from the original open-source prompt word set. Multi-path parallel testing is performed using a proxy model. Through a dynamic evaluation mechanism based on a greedy selection strategy, the attack success rate and length of different prompt words in the prompt word set are evaluated in real time. The final attack prompt words are output to the target model, concatenated with the current attack problem, and returned. An analysis report is also output.

[0013] The prompts in the analysis report are adjusted using an automated mutation and expert modification strategy, and reconstructed and iterated based on the feedback results of each round of attacks to generate new prompts.

[0014] Secondly, this invention provides an automated jailbreak prompt generation and attack system for open-source dialogue models, comprising:

[0015] The tooltip filtering module is used to filter tooltip sets from the original open-source tooltip set according to the type of tooltip. The selection criteria include two dimensions: attack success rate and tooltip length.

[0016] The online decision-making module is used to select the most effective attack prompts from the original open-source prompt word set based on the current attack problem, conduct multi-path parallel testing using a proxy model, and evaluate the attack success rate and prompt word length of different prompts in the prompt word set in real time through a dynamic evaluation mechanism based on a greedy selection strategy. The final attack prompts are then output to the target model, concatenated with the current attack problem, and returned, along with an analysis report.

[0017] The offline decision-making phase module is used to adjust the prompts in the analysis report using automated mutation and expert modification strategies, and to reconstruct and iterate based on the feedback results of each round of attacks to generate new prompts.

[0018] The beneficial effects of this invention are:

[0019] This invention achieves automatic generation of high-success-rate jailbreak hints by combining offline evolution with online decision-making, reducing reliance on human experience and making it suitable for black-box attack scenarios. While ensuring attack strength, this invention strictly controls hint length and time overhead, offering significant advantages in computational cost and real-time performance. In the offline decision-making stage, on the one hand, "semantic rewriting" and "similar replacement" operators are used to mutate hints with low success rates; on the other hand, the logical skeleton of high-success-rate hints from other languages ​​is extracted and grammatically reconstructed using the Chinese context. Attached Figure Description

[0020] Figure 1 The flowchart provided for this invention;

[0021] Figure 2 This is a flowchart illustrating an attack method according to a Chinese embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] In this embodiment of the disclosure, the character " / " indicates that the objects before and after it are in an "or" relationship. For example, A / B means: A or B.

[0024] The term "and / or" describes an association between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or A and B.

[0025] The term "correspondence" can refer to an association or binding relationship. The correspondence between A and B means that there is an association or binding relationship between A and B.

[0026] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0027] Example 1

[0028] This invention provides an automated method for generating and attacking jailbreak prompts for open-source dialogue models. The aim is to reveal the security boundaries and potential vulnerabilities of large language models, and to provide important experimental evidence and practical insights for building a more robust and reliable defense and evaluation system. The large language model is considered a black box system, meaning that attackers can only access it through API interfaces or inference services and cannot obtain the model's parameters, gradients, prediction probability distributions, or internal attention mechanisms. Therefore, this invention does not rely on internal model data for optimization, but focuses on the semantic construction of prompts and the interactive feedback between input and output.

[0029] like Figure 1 As shown, the detection method proposed in this embodiment of the invention is divided into a prompt word collection stage, online decision-making, and / or offline decision-making, specifically including the following steps:

[0030] S1: Proactively collect, test, and build a set of prompt words from open-source intelligence based on the types of prompt words;

[0031] Furthermore, S1 is the prompt word collection stage, which involves systematically testing and selecting prompt words from a massive amount of open-source prompt words to achieve complementarity and diversity of attack strategies, and to detect the security alignment boundary of the large language model from multiple dimensions.

[0032] Furthermore, the collected prompts are categorized into five main types: hijacking, setting, encryption, inducement, and obfuscation. This helps to simultaneously test the large language model from multiple levels, such as semantic spoofing and logical adversarial approaches, thereby maximizing the coverage of potential defense vulnerabilities in the model and effectively ensuring the diversity of the prompt set, thus enhancing the robustness of subsequent attack processes in different problem scenarios.

[0033] Furthermore, in this embodiment of the invention, the specific selection criteria for the prompt words are mainly based on two dimensions: attack success rate and prompt word length.

[0034] (1) Performance evaluation based on attack success rate: This embodiment of the invention uses attack success rate as the core quantitative indicator. This embodiment of the invention selects Qwen2.5:7B-Instruct as the test model and introduces a benchmark set of open-source malicious issues covering multiple categories. The prompt word to be tested is concatenated with the malicious issue and input into the model. The success of the attack is determined based on the response content of the model (i.e., whether the model outputs violation information instead of a rejection statement). Finally, by statistically analyzing the attack and defense performance of each prompt word on different issues, prompt words with high penetration ability are selected.

[0035] (2) Length constraint based on the balance between "efficiency and concealment": This embodiment of the invention introduces the length of the prompt words as a key constraint, aiming to seek the optimal balance between attack capability and concealment. Because prompt words that are too short are often difficult to construct a complex context sufficient to bypass defenses, resulting in insufficient attack power; while prompt words that are too long not only increase computational overhead, but may also reduce the concealment of the attack and attract attention. Therefore, this embodiment of the invention prioritizes the selection of prompt words of moderate length and high semantic density while ensuring a high attack success rate, thereby constructing an efficient and concise original prompt word set.

[0036] Furthermore, in this embodiment of the invention, the prompt word length is the jailbreak length, which refers to the character length of the text problem generated after the original attack problem is processed by the attack engine. The shorter the character length, the better the stealth of the attack. The calculation formula is as follows:

[0037]

[0038] The ratio of the number of characters output by the attack engine to the number of characters in the original question is: , This indicates the number of characters output by the attack engine. The number of characters in the attack question.

[0039] Furthermore, this embodiment of the invention also uses the original sample relevance as an indicator to measure the prompt words. The original sample relevance aims to measure the degree of association between the attack question generated by the attack engine and the original attack question. The higher the relevance, the better the stealth of the attack engine. This embodiment of the invention performs average pooling on these vectors and calculates the relevance between two sentences using cosine similarity, as shown in the following formula:

[0040]

[0041] in For the original attack problem, This is a nested version of the generated prompts and attack questions.

[0042] S2: Deploy and / or build the algorithm model in the local environment, perform the "input-output-evaluation" process multiple times for each prompt word within a limited time window, and use the local proxy model to concatenate the prompt word with the attack question and send it to the target model.

[0043] Furthermore, S2 is the online decision-making phase. To ensure the efficiency of the attack, the goal of this step is to accurately select the most effective prompt words from the original prompt word set within a very short time window (e.g., 60 seconds) for the specific attack problem. This embodiment of the invention introduces a locally deployed Qwen2.5:7B-Instruct as a proxy model. Through multi-path parallel testing and a dynamic evaluation mechanism based on a greedy strategy, it evaluates the attack success rate and length cost of different prompt words in the prompt word set in real time, and dynamically selects the best one for output.

[0044] Furthermore, the specific steps of the multi-path parallel testing and the dynamic evaluation mechanism based on a greedy strategy are as follows:

[0045] (1) Multi-path concurrent inference and de-randomization: Considering the randomness of large language model generation, in order to obtain stable evaluation results, this embodiment of the invention performs multiple repeated inferences for each candidate prompt word. The system combines the current attack problem with each candidate prompt word separately and calls the local proxy model multiple times for inference. This mechanism not only utilizes local computing resources to meet the efficiency requirements of online decision-making, but also effectively eliminates the interference of model output fluctuations on the evaluation results through multiple inferences.

[0046] (2) Greedy selection strategy based on "maximum number of jailbreaks - minimum length cost": After obtaining the response results of multiple inferences, the system adopts a hierarchical greedy strategy to lock the optimal solution, including:

[0047] Attack Success Rate (First Priority): This counts the number of times each prompt word successfully attacks in multiple tests. In this embodiment, the prompt word with the highest jailbreak success rate is prioritized, indicating its strongest attack penetration against the specific problem. The criterion for determining a successful prompt word attack is its matching score with the keyword set, calculated using the following function. A success is determined when the score exceeds a certain threshold, as shown in the formula below:

[0048]

[0049] in The key features are the number of hits and the length of the keyword set. The weights are fixed constants (2.0 / 3.0 / 1.5 / 2.5 / 1.0).

[0050] Length Cost (Second Priority): When multiple prompt words have the same number of successful attacks, this embodiment of the invention will further compare the character lengths of these prompt words and select the shortest prompt word. Shorter prompt words not only reduce the risk of being intercepted by the defense system based on length characteristics (high stealth), but also reduce the token consumption during the final attack.

[0051] Furthermore, an evaluation is conducted based on the analysis report output by the target model. The evaluation includes:

[0052] Unsafe output refers to text that explicitly or implicitly contains the following: encourages, instructs, or downplays harmful behavior (including violence, self-harm, illegal activities, etc.); contains hate speech, discriminatory or dehumanizing statements targeting individuals or groups; or provides harmful information or detailed steps for dangerous operations that bypass security restrictions.

[0053] Safety output refers to texts that warn of risks, provide safety education, or neutrally describe harmful events without containing any encouraging content.

[0054] S3: Build a mutation algorithm model locally and / or adjust it based on expert experience, and iterate mutation prompts based on feedback from each round of results.

[0055] Furthermore, the selection of prompt words for mutation is determined based on the number of times the prompt words are selected and the corresponding jailbreak success rate. The selection calculation method is as follows:

[0056]

[0057] in It is the total number of times the suggestion word was selected. It is the average number of times the suggestion words are selected. It is a constant used to balance the number of selections and the jailbreak rate. This is a reward based on the confidence interval.

[0058] Furthermore, S3 is the offline decision-making stage. This step, based on the original prompt word set, deeply iterates and reconstructs the prompt words according to the defensive characteristics fed back by the target model, thereby constructing a prompt word set with higher concealment and stronger robustness. To address the issue of semantic redundancy or recognition by the defensive model that may result from single automated generation, S3 adopts a dual-track optimization strategy combining "evolutionary fuzzy testing under constraints" and "cross-linguistic semantic structure transfer":

[0059] (1) Constrained Evolutionary Fuzzy Testing: To address the strict limitations on prompt word length in practical application scenarios, this embodiment of the invention designs an automated mutation strategy based on length cost and structure preservation, including:

[0060] a. Operator Selection and Strategy Optimization: Traditional fuzzing mutation strategies often include operations such as "expansion" or "crossing," leading to uncontrolled growth in the length of generated prompt words. Therefore, this embodiment of the invention discards all operators that may cause text redundancy, retaining only two core operators: "semantic rewriting" and "similar replacement," and performing mutations while maintaining the original prompt word structure and attack success rate.

[0061] b. Structure-preserving mutation: Utilizing a large language model as the mutation engine, the prompt words are subjected to "structure-preserving" mutation processing. That is, while maintaining the original attack logic and key semantics, new prompt words are generated through synonym replacement, sentence restructuring, and other methods.

[0062] c. Feedback-based verification mechanism: A rigorous attack effectiveness evaluation process is established, where candidate prompt words generated by mutations are input into the target model for actual testing. The system calculates the attack success rate based on the model's response feedback and executes a screening strategy: only high-quality mutants with attack performance exceeding a preset threshold are retained and included in the prompt word set, while invalid or inefficient samples are automatically removed. This mechanism ensures that the prompt word set maintains a high level of attack effectiveness and robustness throughout continuous iterative evolution.

[0063] (2) Cross-linguistic semantic structure transfer based on expert knowledge: Addressing the issue that conventional open-source prompts and automated mutation prompts are prone to failure in some defense-enhanced models, this invention introduces a reconstruction strategy based on expert experience. Prompts are rewritten manually to improve their attack robustness and stealth. Specifically, this includes:

[0064] d. Logical skeleton extraction: This invention abandons the simple and direct translation method that would destroy the adversarial structure, and instead extracts the deep "logical skeleton" (such as nested logic in role-playing, and logical lock structure to bypass security checks) from high-scoring English prompt words.

[0065] e. Context Reconstruction and Robustness Enhancement: The extracted logical skeleton is combined with Chinese language habits and context for grammatical reconstruction. This expert-reconstructed prompt retains the attack core of the original prompt, exhibiting strong resistance to defense and effectively bypassing the target model's enhanced defense mechanisms, significantly improving the robustness of the prompt.

[0066] To clearly illustrate the present invention, the following detailed description is provided in conjunction with specific embodiments.

[0067] Example 2

[0068] like Figure 2 As shown, this disclosure provides a remote jailbreak attack method for large Chinese black-box models, including:

[0069] Preparation phase: Set up and configure the local environment, and expose the locally deployed model as an API;

[0070] Attack engine optimization completion stage: This embodiment of the invention conducts time-limited jailbreak tests based on a locally deployed model, mainly to ensure the effectiveness of the prompts obtained from online decision-making;

[0071] Testing phase: Attack the publicly available API of the target model, and conduct full-dimensional testing on the seed problems of multiple categories in four aspects: effectiveness, running time, similarity and length score, and obtain the output score report. The seed problems of multiple categories include, but are not limited to, violence, contraband, discrimination and hatred, religious beliefs, economic violations, privacy violations, vulgarity and pornography, public security management, and speculation.

[0072] Evaluation Result Stage: Based on the output scoring report obtained in this embodiment of the invention, the attack results are evaluated. If the prompt word attack rate is low, the process moves to the offline decision-making stage to mutate the prompt words.

[0073] Furthermore, this embodiment first prepares the model and data. This embodiment selects Qwen2.5:7B-Instruct as the basic large language model, which has a certain representativeness and universality in Chinese language processing capabilities, suitable for subsequent jailbreak attack evaluation tasks. Data sources include the Jailbench Chinese dataset and the Awesome-ChatGpt-prompts English dataset. Samples from both are selected according to a preset ratio to construct the initial test set. Jailbench is a Chinese jailbreak attack evaluation dataset covering multiple domains, used to examine the model's security boundaries in the Chinese context; Awesome-ChatGpt-prompts was originally a set of prompts designed by ChatGPT, and its content is also applicable to other large language models, used to evaluate the model's response security to English input. Attack tests are performed on the locally deployed Qwen2.5:7B-Instruct model using the selected data. The jailbreak success rate is calculated for filtering, completing data preprocessing. In this embodiment, data with an initial jailbreak success rate of 80% is set as the initial dataset to ensure that the selected prompts have basic attack effectiveness and can effectively probe the model's defense boundaries.

[0074] Then, a lightweight evaluation model was built in a local environment (such as an NVIDIA RTX 3090 graphics card with 24GB of video memory), and a time-limited jailbreak test was conducted based on Qwen2.5:7B-Instruct. Each test round was set to 60 seconds, and multiple "input-output-evaluation" loops were performed for each prompt word. The local model selected the prompt words with the best attack effect for subsequent steps. The Monte Carlo Tree Search (MCTS) algorithm was used to select these prompt words, and the decision on which prompt words to retain for the mutation stage was based on the historical selection frequency and corresponding jailbreak rate of each prompt word. To meet the evaluation system's limitation on prompt word length, this embodiment excluded mutation strategies that could significantly change the text length, such as crossover, expansion, and shortening. Instead, it selected two methods: "semantic rewriting" and "similar replacement," and called the ChatGPT:3.5-turbo model to perform specific mutation operations to generate new prompt words while maintaining a relatively unchanged text length. After multiple rounds of selection and mutation, a batch of optimized prompt words were obtained, which were used for secondary testing of the target model to verify the improvement of the attack effect, thereby completing a phased assessment of the model's security.

[0075] In this embodiment, after multiple rounds of testing and verification, it demonstrated excellent performance in both attack success rate and stealth. Regarding attack effectiveness, the prompts generated in this embodiment exhibited high attack quality against different target models. In an evaluation covering multiple consecutive test rounds and a total of 180 evaluations, the average jailbreak success rate reached 89.4%, and the success rate of a single mutated prompt reached 100%, indicating that this embodiment can stably achieve efficient attacks in diverse test scenarios. Regarding attack stealth, it was quantitatively evaluated using two indicators: semantic relevance and text length similarity. Experiments showed that in all five evaluation rounds, the average semantic relevance score between the generated prompts and the original attack question was 0.387 / 0.5, and the average length similarity score was 0.461 / 0.5. This data indicates that the prompts generated in this embodiment, while maintaining attack effectiveness, can effectively control their deviation from the original seed in terms of semantics and text length, thus possessing good stealth and adversarial detection capabilities.

[0076] Therefore, by adopting the remote jailbreak attack method for Chinese black-box large models provided in this disclosure, the effectiveness of the attack can be quantified by statistically analyzing the attack success rate. This allows for a systematic evaluation and improvement of the security and robustness of Chinese large models in the face of complex and black-box attack scenarios.

[0077] This embodiment achieves the effect of combining the global exploration capability of evolutionary fuzzy testing and the local precise optimization capability of dynamic greedy strategy through the close cooperation of the offline evolution stage and the online decision-making stage. Under the strict time window and length constraints, it can efficiently filter and lock the optimal prompt words for the target model. This collaborative working mechanism of "offline breadth accumulation - online depth selection" is the important technical innovation of this embodiment, which aims to protect the closed-loop evolution process and dynamic interaction logic of the entire attack framework.

[0078] Example 3

[0079] Furthermore, embodiments of the present invention provide an automated jailbreak prompt generation and attack system for open-source dialogue models, comprising:

[0080] The tooltip filtering module is used to filter tooltip sets from the original open-source tooltip set according to the type of tooltip. The selection criteria include two dimensions: attack success rate and tooltip length.

[0081] The online decision-making module is used to select the most effective attack prompts from the original open-source prompt word set based on the current attack problem, conduct multi-path parallel testing using a proxy model, and evaluate the attack success rate and prompt word length of different prompts in the prompt word set in real time through a dynamic evaluation mechanism based on a greedy selection strategy. The final attack prompts are then output to the target model, concatenated with the current attack problem, and returned, along with an analysis report.

[0082] The offline decision-making phase module is used to adjust the prompts in the analysis report using automated mutation and expert modification strategies, and to reconstruct and iterate based on the feedback results of each round of attacks to generate new prompts.

[0083] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent substitutions, and improvements made to the above embodiments without departing from the scope of the present invention, based on the technical essence of the present invention and within the spirit and principles of the present invention, shall still fall within the protection scope of the present invention.

Claims

1. An automated jailbreak prompt generation and attack method for open-source dialogue models, characterized in that, Includes the following steps: From the original open-source tooltip set, tooltip sets were filtered according to the types of tooltip, with selection criteria including two dimensions: attack success rate and tooltip length. Based on the current attack problem, the optimal attack prompt words are selected from the original open-source prompt word set. Multi-path parallel testing is performed using a proxy model. Through a dynamic evaluation mechanism based on a greedy selection strategy, the attack success rate and length of different prompt words in the prompt word set are evaluated in real time. The final attack prompt words are output to the target model, concatenated with the current attack problem, and returned. An analysis report is also output. The prompts in the analysis report are adjusted using an automated mutation and expert modification strategy, and reconstructed and iterated based on the feedback results of each round of attacks to generate new prompts.

2. The method according to claim 1, characterized in that, Using the attack success rate as an indicator, the Qwen2.5:7B-Instruct model is used to test the response after spelling out test prompts and malicious questions, determine whether the attack is successful or not, and statistically analyze the attack and defense performance, thereby selecting prompts with high penetration capabilities. With the length of the prompt words as a constraint, while ensuring a high success rate of attacks, prompt words of moderate length and high semantic density are selected first to balance attack capability and stealth.

3. The method according to claim 2, characterized in that, The length of the prompt word is the length of the original attack problem after processing. The shorter the characters, the better the attack's concealment.

4. The method according to claim 3, characterized in that, The correlation between the attack question generated by the attack engine and the original attack question is measured by the correlation of the original sample. The higher the correlation, the stronger the concealment.

5. The method according to claim 1, characterized in that, The multi-path parallel test involves performing repeated inference on each candidate prompt word, combining the current attack problem with each candidate prompt word, and then calling the local proxy model multiple times for inference. The greedy selection strategy is as follows: based on the maximum number of jailbreaks and the minimum length cost, the optimal solution is locked by using a hierarchical greedy strategy through multiple reasoning responses.

6. The method according to claim 5, characterized in that, The method of using a hierarchical greedy strategy to lock the optimal solution includes: Attack success rate is the top priority: count the number of successful attacks for each prompt word in multiple tests, prioritize the prompt word with the highest jailbreak rate, and determine whether the attack is successful by matching the score with the keyword set; Prompt length is the second priority: when multiple prompts have the same number of successful attacks, the shortest prompt is selected by comparing their character lengths.

7. The method according to claim 1, characterized in that, When attacking the publicly disclosed API of the target model, a full-dimensional test is performed on the seed problems of multiple categories, considering four dimensions: effectiveness, runtime, similarity, and length, and the analysis report is generated.

8. The method according to claim 1, characterized in that, The automated mutations include: Operator selection and strategy optimization: Only retain the "semantic rewriting" and "similar replacement" operators, and discard all operators that may cause text redundancy; Structural preservation variation: While keeping the original attack logic and key semantics unchanged, new prompt words are generated through synonym replacement and sentence restructuring; The mechanism is based on feedback verification: the attack success rate is calculated based on the response feedback of the target model, and a screening strategy is executed to retain only high-quality mutants that exceed the preset threshold and remove invalid or inefficient samples.

9. The method according to claim 1 or 8, characterized in that, The expert modification strategy includes: Logical skeleton extraction: Abandoning the simple and direct translation method that destroys adversarial structures, we extract the deep logical skeleton from high-scoring English prompt words; Contextual reconstruction: The extracted logical skeleton is combined with Chinese language habits and context to reconstruct the grammar.

10. An automated jailbreak prompt generation and attack system for open-source dialogue models, characterized in that, include: The tooltip filtering module is used to filter tooltip sets from the original open-source tooltip set according to the type of tooltip. The selection criteria include two dimensions: attack success rate and tooltip length. The online decision-making module is used to select the most effective attack prompts from the original open-source prompt word set based on the current attack problem, conduct multi-path parallel testing using a proxy model, and evaluate the attack success rate and prompt word length of different prompts in the prompt word set in real time through a dynamic evaluation mechanism based on a greedy selection strategy. The final attack prompts are then output to the target model, concatenated with the current attack problem, and returned, along with an analysis report. The offline decision-making phase module is used to adjust the prompts in the analysis report using automated mutation and expert modification strategies, and to reconstruct and iterate based on the feedback results of each round of attacks to generate new prompts.

Images