Decomposing and Reconstructing Prompts for More Effective LLM Jailbreak Attacks

DrAttack: Using Prompt Decomposition to Jailbreak LLMs

I’ve been studying this new paper on LLM jailbreaking techniques. The key contribution is a systematic approach called DrAttack that decomposes malicious prompts into fragments, then reconstructs them to bypass safety measures. The method works by exploiting how LLMs process prompt structure rather than relying on traditional adversarial prompting.

Main technical components: – Decomposition: Splits harmful prompts into semantically meaningful fragments – Reconstruction: Reassembles fragments using techniques like shuffling, insertion, and formatting – Attack Strategies: – Semantic preservation while avoiding detection – Context manipulation through strategic placement – Exploitation of prompt processing order

Key results: – Achieved jailbreaking success rates of 83.3% on GPT-3.5 – Demonstrated effectiveness across multiple commercial LLMs – Showed higher success rates compared to baseline attack methods – Maintained semantic consistency of generated outputs

The implications are significant for LLM security: – Current safety measures may be vulnerable to structural manipulation – Need for more robust prompt processing mechanisms – Importance of considering decomposition attacks in safety frameworks – Potential necessity for new defensive strategies focused on prompt structure

TLDR: DrAttack introduces a systematic prompt decomposition and reconstruction method to jailbreak LLMs, achieving high success rates by exploiting how models process prompt structure rather than using traditional adversarial techniques.

Full summary is here. Paper here.