How Does the New ASCII Art Jailbreak Bypass GPT-4, Claude, Gemini, and LLaMA?

TL;DR

The new ArtPrompt jailbreak bypasses some language-model safeguards by replacing rejection-triggering words with ASCII art and instructing the model to decode them. Researchers tested the technique against five models, GPT-3.5, GPT-4, Gemini, Claude, and Llama 2, and found that they struggled to recognize prompts in this visual form. Read on to understand the two-step attack and why semantics-focused safety alignment leaves this opening.

Transcript

there is a new jailbreak technique that has AI companies scrambling and it actually uses something that's been on the internet for pretty much as long as the internet has been around so I'm going to tell you about it and then we're going to test it out and see if it works all right this is the research paper but before we actually get into it let m... Read More

Key Insights

• 🌥️ Large language models have become more aligned with safety measures, making jailbreaking techniques more challenging.
• 🥰 The ASCII art-based jailbreak technique leverages ASCII art representations to bypass model filters and censorship.
• 🥰 State-of-the-art language models, including GPT 3.5, GPT 4, Gemini, Claude, and Llama 2, exhibit vulnerability to the ASCII art-based jailbreak technique.
• 🦺 Previous jailbreaking techniques have been patched to enhance model safety and alignment.
• 👊 The research paper suggests that semantics-only interpretation of prompts during safety alignment can create vulnerabilities to jailbreak attacks.
• 🥰 The paper introduces a comprehensive benchmark challenge to measure the susceptibility of language models to the ASCII art-based jailbreak technique.
• 🌍 The success rate of the ASCII art-based jailbreak technique varies across different models, with GPT 4 showing the highest susceptibility.

Questions & Answers

Q: How does the ASCII art jailbreak bypass GPT-4, Claude, Gemini, and Llama 2 safeguards?

The technique masks a word that would normally trigger rejection by visually encoding it as ASCII art. The model is then instructed to decode and use that masked word, allowing the prompt to avoid filters that focus on ordinary semantic text.

Q: What is the new AI jailbreak technique called?

The research paper calls the technique ArtPrompt and describes it as an ASCII art-based jailbreak attack against aligned large language models. It uses ordinary letters, numbers, and characters to visually represent filtered words.

Q: What is jailbreaking in the context of large language models?

Jailbreaking means prompting a large language model to produce results it has been aligned not to provide. The transcript also identifies prompt hacking and prompt injection as terms used for essentially the same objective.

Q: What are the two steps in the ArtPrompt attack?

First, ArtPrompt finds words in a prompt that may trigger rejection by the language model. Second, it creates cloaked prompts by encoding those words as ASCII art and sends the resulting prompts to the target model.

Q: Which AI models were tested against the ASCII art jailbreak?

The researchers tested five state-of-the-art models: GPT-3.5, GPT-4, Gemini, Claude, and Llama 2. According to the paper as presented in the transcript, all five struggled to recognize prompts provided as ASCII art.

Q: Why can ASCII art expose a weakness in language-model safety alignment?

Known safety techniques described in the paper presume that safety-alignment content is interpreted through semantics, meaning ordinary words. ASCII art visually masks sensitive words, creating an input form that those protections may fail to recognize properly.

Q: What safety techniques had already strengthened large language models against jailbreaks?

The paper names data filtering and supervised fine-tuning as techniques developed to strengthen large-language-model safety. AI companies had also become better at detecting earlier prompt tricks, including requests framed as fictional movie scripts.

Q: What benchmark did the ArtPrompt researchers introduce?

The researchers introduced a comprehensive benchmark called the Vision-in-Text Challenge. It is intended to measure how susceptible large language models are to the new ASCII art-based jailbreak attack.

Summary & Key Takeaways

• Jailbreaking refers to obtaining forbidden information from large language models like GPT through creative prompts.

• Researchers have discovered a new technique called "ASCII art-based jailbreak" that masks prompts using ASCII art, allowing them to bypass model filters.

• This technique was tested on various state-of-the-art language models and found to have a high success rate.