├── .gitignore
├── README.md
├── config.py
├── construct_dataset.py
├── data
├── circuit_breaker_train.csv
└── harmbench.csv
├── ft
├── llama3_8b_instruct_qlora.py
├── lora_merge.sh
└── lora_train.sh
├── inattack.py
├── judge.py
├── main.py
├── paper
├── intro.png
├── main_res.png
└── pipe_bomb_making_gpto1.jpg
├── preattack.py
├── prompts
├── 1_extract.txt
├── 2_network.txt
├── 3_actor.txt
├── 3_more_actor.txt
├── 4_queries.txt
├── 5_json_format.txt
├── attack_modify.txt
├── attack_step_judge.txt
└── get_safe_response.txt
├── requirements.txt
└── utils.py
/.gitignore:
--------------------------------------------------------------------------------
1 | pre_attack_result/*
2 | attack_result/*
3 | dataset_result/*
4 | __pycache__/*
5 | .env
6 | ft/work_dirs/*
7 | *.ipynb
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 |
2 |
3 | 💥Derail Yourself: Multi-turn LLM Jailbreak Attack through Self-discovered Clues
4 | 
5 | 
6 |
7 |
RESEARCH USE ONLY✅ NO MISUSE❌
10 | LOVE💗 and Peace🌊
11 |
12 |
13 | ## 🆙Updates
14 | * [x] 2024-10-14: We release [SafeMTData](https://huggingface.co/datasets/SafeMTData/SafeMTData) which inclues our multi-turn jailbreak data and the multi-turn safety alignment data on huggingface.
15 | * [ ] We will release a more 10K multi-turn safety alignment data soon.
16 |
17 | ## 📄 Brief Information for each file and directory
18 | - `data` ---> includes the original jailbreak benchmark data.
19 | - `prompts` ---> are the prompts for attack data generation, evaluation, and safety alignment data generation.
20 | - `main.py` ---> is the file to run ActorAttack, which consists of two-stages: pre-attack (`preattack.py`) and in-attack (`inattack.py`).
21 | - `judge.py` ---> is the file to define our GPT-Judge.
22 | - `ft` ---> contains the script and python file to train LLMs.
23 | - `construct_dataset.py` ---> is the file to construct the multi-turn safety alignment data.
24 |
25 |
26 | ## 🛠️ Attack data generation
27 | - Installation
28 | ```
29 | conda create -n actorattack python=3.10
30 | conda activate actorattack
31 | pip install -r requirements.txt
32 | ```
33 | - Before running, you need to set the API credentials in your environment variables. An example of using your `.env` file is:
34 | ```
35 | BASE_URL_GPT="https://api.openai.com/v1"
36 | GPT_API_KEY="YOUR_API_KEY"
37 |
38 | BASE_URL_CLAUDE="https://api.anthropic.com/v1"
39 | CLAUDE_API_KEY="YOUR_API_KEY"
40 |
41 | BASE_URL_DEEPSEEK="https://api.deepseek.com/v1"
42 | DEEPSEEK_API_KEY="YOUR_API_KEY"
43 |
44 | BASE_URL_DEEPINFRA="https://api.deepinfra.com/v1/openai"
45 | DEEPINFRA_API_KEY="YOUR_API_KEY"
46 | ```
47 |
48 | ## ⚡️ Model Recommendation for Attack Generation
49 | We have noticed that GPT-4o, when used as an attack model, tends to refuse to generate multi-turn attack prompts. Therefore, we recommend using the open-source LLM WizardLM-2-8x22B. (You can also access the model through the DeepInfra API via microsoft/WizardLM-2-8x22B.)
50 |
51 | ✨An example run:
52 |
53 | ```
54 | python3 main.py --questions 1 \
55 | --actors 3 \
56 | --behavior ./data/harmbench.csv \
57 | --attack_model_name gpt-4o \
58 | --target_model_name gpt-4o \
59 | --early_stop \
60 | --step_modify
61 | ```
62 |
63 |
64 | You can find the actors and initial jailbreak queries for each instruction in `pre_attack_result`, and the final attack result in `attack_result`.
65 |
66 | ## 🛠️ Safety Fine-tuning
67 | 1. Generate multi-turn jailbreak queries based on ActorAttack.
68 | ```
69 | python3 main.py --questions 1000 \
70 | --actors 3 \
71 | --behavior ./data/circuit_breaker_train.csv \
72 | --attack_model_name WizardLM-2-8x22B \
73 | --target_model_name deepseek-chat \
74 | --early_stop
75 | ```
76 | 2. Generate multi-turn safety alignment dataset based on the above attack data.
77 | ```
78 | python3 construct_dataset.py \
79 | --attack_data_file ./attack_result/your_file_name \
80 | ```
81 | 3. Fine-tune LLM using our multi-turn safety alignment data.
82 | ```
83 | sh ft/scripts/lora_train.sh your_defense_dataset_path
84 | sh ft/scripts/lora_merge.sh your_train_iter
85 | ```
86 |
87 | ## 💡Motivation & Method
88 | As shown in the figure, we expose a significant safety vulnerability of LLMs in multi-turn scenarios, which enable the malicious users to hide their intentions.
89 |
90 |
91 |
97 |
98 |
103 |
104 |