A large model multi-round jailbreaking attack method, system, medium and equipment based on pattern enhancement
Patent Information
- Application Number
- CN202610875502.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-06-17
- Publication Date
- 2026-10-16
AI Technical Summary
[0005]本发明所要解决的技术问题是，提供一种基于模式增强的大模型多轮越狱攻击方法、系统、介质及设备，解决现有技术缺乏对对话结构模式的系统性挖掘，导致难以揭示模型深层对齐缺陷的问题
[0050] (1) Through structured dialogue patterns, the vulnerabilities of different large model architectures under specific dialogue patterns can be effectively explored, thereby achieving a higher attack success rate;
Smart Images
Figure CN122926412A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to a method, system, medium, and device for large-scale, multi-round jailbreak attacks based on pattern enhancement, belonging to the field of artificial intelligence security technology. Background Technology
[0002] Large language models have been widely used in content generation, customer service, and other fields. To prevent the models from being abused, developers typically use alignment techniques such as RLHF (Reinforcement Learning from Human Feedback) to securely train the models. However, attackers are constantly developing jailbreak attacks to bypass these secure alignment mechanisms and induce the models to generate harmful content.
[0003] Existing jailbreak attacks are mainly divided into single-turn attacks and multi-turn attacks. Single-turn attacks attempt to inject malicious commands through a single complex prompt, but with the upgrading of security mechanisms, the success rate of such attacks has been significantly reduced. Multi-turn attacks attempt to gradually guide the model through multiple rounds of dialogue, but existing multi-turn attack methods often lack a systematic understanding of the dialogue structure and rely heavily on heuristic or random exploration strategies. This randomness makes the attack success rate highly dependent on the bias of the prompt model, making it difficult to reliably reveal the deep vulnerabilities of the model under specific dialogue structures.
[0004] The main problem with existing technologies is the lack of a systematic attack framework that combines dialogue structure patterns with semantic advancement. This makes it difficult to effectively exploit structural vulnerabilities in large language models under specific dialogue patterns, and the attack process lacks interpretability. Due to the flaws in existing attack methods, it is difficult to improve the resilience of large language models through effective security training, thus hindering the improvement of their security performance. Summary of the Invention
[0005] The technical problem to be solved by the present invention is to provide a method, system, medium and device for multi-round jailbreak attacks based on pattern enhancement, which solves the problem that the existing technology lacks systematic mining of dialogue structure patterns, making it difficult to reveal deep alignment defects of the model.
[0006] To achieve the above objectives, the present invention employs the following technical solution:
[0007] Firstly, this invention proposes a large-scale, multi-round jailbreak attack method based on pattern enhancement, comprising:
[0008] Obtain a pre-built library of dialogue patterns;
[0009] Based on the dialogue pattern library, a target dialogue pattern is selected, and a multi-turn candidate prompt word sequence corresponding to the target dialogue pattern and the target harmful content is obtained. An initial attack chain is selected from the multi-turn candidate prompt word sequence. The target harmful content is the harmful content that is intended to induce the target large model to generate.
[0010] The initial attack chain is submitted to the target large model to obtain the target large model response. The comprehensive evaluation score of the semantic relevance and pattern consistency of the target large model response is calculated.
[0011] Based on the comprehensive evaluation score and the pre-defined chain update strategy, the initial attack chain is iteratively optimized to obtain an optimized attack chain. The optimized attack chain is then used to attack the target large model until the target large model is successfully induced to output harmful content or the preset maximum number of iterations is reached.
[0012] Furthermore, the dialogue pattern library includes technical education patterns, personal experience patterns, hypothetical scenario patterns, information acquisition patterns, and problem-solving patterns;
[0013] The technology education model disguises attacks as academic discussions or technology learning processes for dialogue.
[0014] The personal experience model utilizes narrative empathy mechanisms to construct personal stories for dialogue;
[0015] The hypothetical scenario model engages in dialogue by isolating real-world responsibilities through fictional settings.
[0016] The information acquisition mode uses a neutral knowledge-based question-and-answer format for dialogue.
[0017] The problem-solving model described above engages in dialogue through a task-oriented, step-by-step solution approach.
[0018] Further, the step of selecting the initial attack chain from the multi-round candidate prompt word sequence includes:
[0019] Calculate the semantic relevance and pattern consistency of the candidate prompt word sequence;
[0020] Based on the semantic relevance and pattern consistency of the candidate prompt word sequences, the prompt word sequence with the highest total score is selected as the initial attack chain;
[0021] The calculation process for the semantic relevance includes:
[0022] The candidate prompt word sequence is converted into a candidate prompt word vector, and the target harmful content is converted into a target harmful vector;
[0023] Based on the candidate prompt word vectors and the target harmful vectors, the semantic relevance of the candidate prompt word sequence is calculated using the cosine similarity formula;
[0024] The pattern consistency is generated through a pre-acquired model.
[0025] Furthermore, the calculation of the semantic relevance and pattern consistency of the target large model response to obtain a comprehensive evaluation score includes:
[0026] Calculate the semantic relevance and pattern consistency of the target large model response, respectively;
[0027] Based on the semantic relevance and pattern consistency of the target large model response, a weighted sum of the semantic relevance and pattern consistency of the target large model response is calculated to obtain a comprehensive evaluation score.
[0028] Furthermore, the initial attack chain includes a series of sequential rounds, which correspond to the order of the prompts selected from the multi-round candidate prompt sequence;
[0029] The chain update strategy includes:
[0030] The forward strategy is to proceed to the next round when the semantic relevance of the target large model's response increases;
[0031] The regeneration strategy involves regenerating prompt words in the current round when the semantic relevance of the target large model response decreases and the pattern consistency increases.
[0032] The backtracking strategy involves reverting to the previous round and regenerating prompt words when both the semantic relevance and pattern consistency of the target large model's response decrease.
[0033] The mode switching strategy involves switching to another mode in the dialogue mode library and reselecting the initial attack chain when the current mode cannot proceed.
[0034] Furthermore, it also includes:
[0035] Record the success rate and vulnerability data of each dialogue mode during the jailbreak attack;
[0036] Based on the success rate and vulnerability data of each dialogue mode, a vulnerability profile of the target large model by mode category is generated.
[0037] Furthermore, the success rate is the ratio of the number of successful attacks to the total number of attacks;
[0038] The vulnerability data includes high-risk dialogue patterns and semantic vulnerabilities;
[0039] The process of acquiring the vulnerability data includes:
[0040] The high-risk dialogue modes of the target large model are determined based on the success rate of each dialogue mode.
[0041] Extract the last round of prompt words from the optimized attack chain that successfully launched the attack, use the pre-acquired model to identify and cluster semantic topics that appear more frequently than a preset frequency, and mark the semantic topics that appear more frequently than the preset frequency as semantic vulnerabilities of the target large model.
[0042] Secondly, this invention proposes a large-scale, multi-round jailbreak attack system based on pattern enhancement, comprising:
[0043] The dialogue pattern library acquisition module is used to acquire a pre-built dialogue pattern library;
[0044] The initial attack chain generation module selects a target dialogue pattern based on the dialogue pattern library, generates a multi-round candidate prompt word sequence corresponding to the target dialogue pattern and the target harmful content using a pre-acquired model, and selects an initial attack chain from the multi-round candidate prompt word sequence; the target harmful content is the harmful content that is intended to induce the target large model to generate.
[0045] The comprehensive evaluation score calculation module is used to submit the initial attack chain to the target large model, obtain the response of the target large model, and calculate the comprehensive evaluation score of the semantic relevance and pattern consistency of the response of the target large model.
[0046] The attack chain iteration optimization module is used to iteratively optimize the initial attack chain based on the comprehensive evaluation score and the pre-defined chain update strategy until the target large model is successfully induced to output harmful content or the preset maximum number of iterations is reached.
[0047] Thirdly, the present invention also discloses a computer-readable storage medium for storing one or more programs, said one or more programs including instructions that, when executed by a computing device, cause the computing device to perform the method described in the first aspect.
[0048] Fourthly, the present invention also discloses a computer device comprising one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include instructions for performing the method described in the first aspect.
[0049] The beneficial effects achieved by this invention are as follows:
[0050] (1) Through structured dialogue patterns, the vulnerabilities of different large model architectures under specific dialogue patterns can be effectively explored, thereby achieving a higher attack success rate;
[0051] (2) By calculating the semantic relevance and pattern consistency of the large model response, the effect of jailbreak attacks can be quantified, and the effect of attack chain iteration can be intuitively reflected.
[0052] (3) By formulating a chain update strategy, the attack chain can be automatically optimized, reducing manual operation and lowering the maintenance cost of the solution. Attached Figure Description
[0053] Figure 1 This is a flowchart illustrating the pattern-enhanced large-model multi-round jailbreak attack method of the present invention. Detailed Implementation
[0054] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.
[0055] Example 1, as Figure 1 As shown, this invention discloses a large-scale multi-round jailbreak attack method based on pattern enhancement, including:
[0056] S1: Obtain a pre-built library of dialogue patterns;
[0057] S2: Select a target dialogue pattern based on the dialogue pattern library, obtain a multi-turn candidate prompt word sequence corresponding to the target dialogue pattern and the target harmful content, and select an initial attack chain from the multi-turn candidate prompt word sequence; the target harmful content is the harmful content that is intended to induce the target large model to generate.
[0058] S3: Submit the initial attack chain to the target large model, obtain the target large model response, and calculate the comprehensive evaluation score of the semantic relevance and pattern consistency of the target large model response;
[0059] S4: Based on the comprehensive evaluation score and the pre-defined chain update strategy, the initial attack chain is iteratively optimized to obtain an optimized attack chain, and the optimized attack chain is used to attack the target large model until the target large model is successfully induced to output harmful content or the preset maximum number of iterations is reached.
[0060] The following is a detailed explanation of each step.
[0061] Step S1: Obtain a pre-built library of dialogue patterns designed to provide structured path guidance for attacks.
[0062] The dialogue pattern library includes technical education patterns, personal experience patterns, hypothetical scenario patterns, information acquisition patterns, and problem-solving patterns.
[0063] The technology education model utilizes the model's helpful nature in educational scenarios to package attacks as academic discussions or technology learning processes for dialogue. The dialogue in this model generally unfolds in the form of concept-application-implementation.
[0064] The personal experience model uses a narrative empathy mechanism to construct personal stories for dialogue. The dialogue in this model generally unfolds through sharing, empathy, and seeking help.
[0065] The hypothetical scenario model uses fictional scenarios to isolate real-world responsibilities for dialogue, inducing the model to engage in role-playing.
[0066] The information acquisition mode uses a neutral knowledge question-and-answer format to conduct dialogue by leveraging the bias of the information provided by the model;
[0067] The problem-solving model described above engages in dialogue through a task-oriented, step-by-step solution approach.
[0068] Step S2: Select a target dialogue pattern based on the dialogue pattern library, obtain a multi-turn candidate prompt word sequence corresponding to the target dialogue pattern and the target harmful content, and select an initial attack chain from the multi-turn candidate prompt word sequence; the target harmful content is the harmful content that is intended to induce the target large model to generate; this step aims to generate an initial attack path, and the multi-turn candidate prompt word sequence is generated by existing models such as GPT5, Claude, and Deepseek.
[0069] The step of selecting the initial attack chain from the multi-round candidate prompt word sequence includes:
[0070] Calculate the semantic relevance and pattern consistency of the candidate prompt word sequence;
[0071] Based on the semantic relevance and pattern consistency of the candidate prompt word sequences, the prompt word sequence with the highest total score is selected as the initial attack chain;
[0072] The calculation process for the semantic relevance includes:
[0073] The candidate prompt word sequence is converted into a candidate prompt word vector, and the target harmful content is converted into a target harmful vector;
[0074] Based on the candidate prompt word vectors and the target harmful vectors, the semantic relevance of the candidate prompt word sequence is calculated using the cosine similarity formula;
[0075] The pattern consistency is generated through the pre-acquired existing model.
[0076] Step S3: Submit the initial attack chain to the target large model, obtain the target large model response, and calculate the comprehensive evaluation score of the semantic relevance and pattern consistency of the target large model response.
[0077] Semantic relevance utilizes an embedding model to calculate the semantic similarity between the current response and the target large model, measuring the extent to which the attack approaches the target. The embedding model here is OpenAI, which converts text into vectors using OpenAI's text-embedding and then calculates semantic similarity using the cosine similarity formula. Pattern consistency uses an adjudicator model to evaluate whether the currently generated prompts conform to the current stage features of a predefined dialogue pattern, ensuring the natural fluency of the dialogue. The adjudicator model here is a large language model such as GPT5, Claude, or Deepseek. The total evaluation score is a weighted sum of semantic relevance and pattern consistency, used to guide subsequent strategy selection.
[0078] The calculation of the semantic relevance and pattern consistency of the target large model response to obtain a comprehensive evaluation score includes:
[0079] Calculate the semantic relevance and pattern consistency of the target large model response, respectively;
[0080] Based on the semantic relevance and pattern consistency of the target large model response, a weighted sum of the semantic relevance and pattern consistency of the target large model response is calculated to obtain a comprehensive evaluation score.
[0081] Step S4: Based on the comprehensive evaluation score and the pre-defined chain update strategy, the initial attack chain is iteratively optimized to obtain an optimized attack chain. This optimized attack chain is then used to attack the target large model until it successfully induces the target large model to output harmful content or reaches the preset maximum number of iterations. This step is the core logic of the invention, based on a decision engine selecting a strategy according to changes in the evaluation score, simulating the flexible adjustments humans make in dialogue.
[0082] The initial attack chain comprises a series of sequential rounds, which correspond to the order of the prompts selected from the multi-round candidate prompt sequence.
[0083] The chain update strategy includes:
[0084] The forward strategy is to proceed to the next round when the semantic relevance of the target large model's response increases;
[0085] The regeneration strategy involves regenerating prompt words in the current round when the semantic relevance of the target large model response decreases and the pattern consistency increases.
[0086] The backtracking strategy involves reverting to the previous round and regenerating prompt words when both the semantic relevance and pattern consistency of the target large model's response decrease.
[0087] The mode switching strategy involves switching to another mode in the dialogue mode library and reselecting the initial attack chain when the current mode cannot proceed.
[0088] The present invention also includes:
[0089] Record the success rate and vulnerability data of each dialogue mode during the jailbreak attack;
[0090] Based on the success rate and vulnerability data of each dialogue mode, a vulnerability profile of the target large model by mode category is generated.
[0091] This step provides an interpretable, structured perspective on the security alignment vulnerabilities in the analysis model, which helps in developing more targeted defense mechanisms.
[0092] The success rate is the ratio of the number of successful attacks to the total number of attacks.
[0093] The vulnerability data includes high-risk dialogue patterns and semantic vulnerabilities;
[0094] The process of acquiring the vulnerability data includes:
[0095] The high-risk dialogue modes of the target large model are determined based on the success rate of each dialogue mode.
[0096] Extract the last round of prompt words from the optimized attack chain that successfully launched the attack, use the pre-acquired model to identify and cluster semantic topics that appear more frequently than a preset frequency, and mark the semantic topics that appear more frequently than the preset frequency as semantic vulnerabilities of the target large model.
[0097] Example 2, based on the same inventive concept as Example 1, proposes a large-scale multi-round jailbreak attack system based on pattern enhancement, comprising:
[0098] The dialogue pattern library acquisition module is used to acquire a pre-built dialogue pattern library;
[0099] The initial attack chain generation module is used to select a target dialogue pattern based on the dialogue pattern library, generate a multi-round candidate prompt word sequence corresponding to the target dialogue pattern and the target harmful content using a pre-acquired model, and select an initial attack chain from the multi-round candidate prompt word sequence; the target harmful content is harmful content that is intended to induce the target large model to generate.
[0100] The comprehensive evaluation score calculation module is used to submit the initial attack chain to the target large model, obtain the response of the target large model, and calculate the comprehensive evaluation score of the semantic relevance and pattern consistency of the response of the target large model.
[0101] The attack chain iteration optimization module is used to iteratively optimize the initial attack chain based on the comprehensive evaluation score and the pre-defined chain update strategy until the target large model is successfully induced to output harmful content or the preset maximum number of iterations is reached.
[0102] Example 3, based on the same inventive concept as other examples, discloses a computer-readable storage medium storing one or more programs, the one or more programs including instructions that, when executed by a computing device, cause the computing device to perform the method described in Example 1.
[0103] Example 4: The present invention also discloses a computer device, including one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include instructions for performing the method described in Example 1.
[0104] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0105] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0106] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0107] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0108] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.
Claims
1. A large-scale, multi-round jailbreak attack method based on pattern enhancement, characterized in that, include: Obtain a pre-built library of dialogue patterns; Based on the dialogue pattern library, a target dialogue pattern is selected, and a multi-round candidate prompt word sequence corresponding to the target dialogue pattern and the target harmful content is obtained. An initial attack chain is selected from the multi-round candidate prompt word sequence. The target harmful content refers to harmful content that is intended to induce the target large model to generate; The initial attack chain is submitted to the target large model to obtain the target large model response. The comprehensive evaluation score of the semantic relevance and pattern consistency of the target large model response is calculated. Based on the comprehensive evaluation score and the pre-defined chain update strategy, the initial attack chain is iteratively optimized to obtain an optimized attack chain. The optimized attack chain is then used to attack the target large model until the target large model is successfully induced to output the target harmful content or the preset maximum number of iterations is reached.
2. The large-scale multi-round jailbreak attack method based on pattern enhancement according to claim 1, characterized in that, The dialogue pattern library includes technical education patterns, personal experience patterns, hypothetical scenario patterns, information acquisition patterns, and problem-solving patterns. The technology education model disguises attacks as academic discussions or technology learning processes for dialogue. The personal experience model utilizes narrative empathy mechanisms to construct personal stories for dialogue; The hypothetical scenario model engages in dialogue by isolating real-world responsibilities through fictional settings. The information acquisition mode uses a neutral knowledge-based question-and-answer format for dialogue. The problem-solving model described herein engages in dialogue through a task-oriented, step-by-step solution approach.
3. The large-scale multi-round jailbreak attack method based on pattern enhancement according to claim 1, characterized in that, The step of selecting the initial attack chain from the multi-round candidate prompt word sequence includes: Calculate the semantic relevance and pattern consistency of the candidate prompt word sequence; Based on the semantic relevance and pattern consistency of the candidate prompt word sequences, the prompt word sequence with the highest total score is selected as the initial attack chain; The calculation process for the semantic relevance includes: The candidate prompt word sequence is converted into a candidate prompt word vector, and the target harmful content is converted into a target harmful vector; Based on the candidate prompt word vectors and the target harmful vectors, the semantic relevance of the candidate prompt word sequence is calculated using the cosine similarity formula; The pattern consistency is generated through a pre-acquired model.
4. The large-scale multi-round jailbreak attack method based on pattern enhancement according to claim 3, characterized in that, The calculation of the semantic relevance and pattern consistency of the target large model response to obtain a comprehensive evaluation score includes: Calculate the semantic relevance and pattern consistency of the target large model response, respectively; Based on the semantic relevance and pattern consistency of the target large model response, a weighted sum of the semantic relevance and pattern consistency of the target large model response is calculated to obtain a comprehensive evaluation score.
5. The large-scale multi-round jailbreak attack method based on pattern enhancement according to claim 4, characterized in that, The initial attack chain comprises a series of sequential rounds, the sequential rounds corresponding to the order of prompts selected from the multi-round candidate prompt sequence; The chain update strategy includes: The forward strategy is to proceed to the next round when the semantic relevance of the target large model's response increases; The regeneration strategy involves regenerating prompt words in the current round when the semantic relevance of the target large model response decreases and the pattern consistency increases. The backtracking strategy involves reverting to the previous round and regenerating prompt words when both the semantic relevance and pattern consistency of the target large model's response decrease. The mode switching strategy involves switching to another mode in the dialogue mode library and reselecting the initial attack chain when the current mode cannot proceed.
6. The large-scale multi-round jailbreak attack method based on pattern enhancement according to claim 1, characterized in that, Also includes: Record the success rate and vulnerability data of each dialogue mode during the jailbreak attack; Based on the success rate and vulnerability data of each dialogue mode, a vulnerability profile of the target large model by mode category is generated.
7. The large-scale multi-round jailbreak attack method based on pattern enhancement according to claim 6, characterized in that, The success rate is the ratio of the number of successful attacks to the total number of attacks. The vulnerability data includes high-risk dialogue patterns and semantic vulnerabilities; The process of acquiring the vulnerability data includes: The high-risk dialogue modes of the target large model are determined based on the success rate of each dialogue mode. Extract the last round of prompt words from the optimized attack chain that successfully launched the attack, use the pre-acquired model to identify and cluster semantic topics that appear more frequently than a preset frequency, and mark the semantic topics that appear more frequently than the preset frequency as semantic vulnerabilities of the target large model.
8. A large-scale, multi-round jailbreak attack system based on pattern enhancement, characterized in that, include: The dialogue pattern library acquisition module is used to acquire a pre-built dialogue pattern library; The initial attack chain generation module is used to select a target dialogue pattern based on the dialogue pattern library, generate a multi-round candidate prompt word sequence corresponding to the target dialogue pattern and the target harmful content using a pre-acquired model, and select an initial attack chain from the multi-round candidate prompt word sequence. The target harmful content refers to harmful content that is intended to induce the target large model to generate; The comprehensive evaluation score calculation module is used to submit the initial attack chain to the target large model, obtain the response of the target large model, and calculate the comprehensive evaluation score of the semantic relevance and pattern consistency of the response of the target large model. The attack chain iteration optimization module is used to iteratively optimize the initial attack chain based on the comprehensive evaluation score and the pre-defined chain update strategy to obtain an optimized attack chain, and then attack the target large model through the optimized attack chain until the target large model is successfully induced to output harmful content or the preset maximum number of iterations is reached.
9. A computer-readable storage medium for storing one or more programs, characterized in that, The one or more programs include instructions that, when executed by a computing device, cause the computing device to perform any of the methods of claims 1 to 7.
10. A computer device, characterized in that, include, One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including instructions for performing the method of any of claims 1 to 7.