Cipher attacks can bypass language model safety without fine tuning
Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuning
Cryptography and SecurityArtificial Intelligence
Summary
Language models like those behind chatbots have safety features to prevent harmful replies. This paper shows that attackers can secretly encrypt harmful requests so they look like gibberish to the model’s filters. Surprisingly, the attackers don’t need to retrain or fine-tune the model; they can make it understand encrypted harmful messages just by clever prompting. This creates a new way to trick popular AI models into giving unsafe responses without being detected.
What this means in practice
- •For ai safety teams: Detect and prevent hidden cipher attacks that bypass harmful content filters in large language models.
- •For cybersecurity analysts: Identify new covert communication methods exploiting language models without needing model access or fine-tuning.
Authors
Thomas Rivasseau
Abstract
Large language model safety and security research is preoccupied with, among other things, detecting and preventing jailbreak attacks: alignment bypasses that allow an adversarial user to elicit unwanted or harmful outputs from models. Arbitrary cipher, or covert communication, attacks are one such type of jailbreak and have previously been demonstrated against the fine-tuning APIs of commercial models. In these attacks, target models are trained on a corpus of encrypted harmful questions and responses and subsequently respond to harmful requests through the learned encryption scheme. In this paper, we show that newer frontier models do not require fine-tuning to acquire cipher-based communication skills. Instead, they can learn these skills through prompting and, when necessary, through in-context learning. Furthermore, model alignment is significantly weakened or entirely bypassed when communication occurs through the learned cipher. To the best of our knowledge, this constitutes a novel attack vector against commercial black-box large language models. We demonstrate successful jailbreaks against frontier models developed by Anthropic, Google, and OpenAI. Our attack bypasses commercial harmfulness classifiers because harmful content is encrypted and therefore appears as nonsensical text or gibberish.