Controlled Decoding Attacks on Black-Box LLMs
A text-only controlled-decoding method jailbreaks black-box LLMs by reconstructing and steering token distributions at a few positions.
The paper studies jailbreaks against black-box LLMs whose interfaces return only sampled text, not weights or token probabilities. It reconstructs a usable next-token distribution from samples plus a prior over unobserved tokens, then uses the response prefix to decide when reconstruction and distribution edits are worthwhile. Speculative multi-token execution accepts draft prefixes that need no change, reducing target queries. Across four unnamed endpoints and three benchmarks, the method records the highest mean score in most comparisons with baselines.
- The attack jailbreaks black-box LLMs using only sampled text, not weights or logits.
- Sampled outputs plus a prior reconstruct a usable next-token control signal.
- Risk gating and speculative drafts concentrate queries on a few generation positions.
- It leads most comparisons across four endpoints and three benchmarks.
From the original article
1 min read at arxiv.orgManipulating next-token probabilities during generation can bypass the safety alignment of large language models. Existing approaches, however, rely on access to model weights or numerical token probabilities and therefore do not apply to interfaces that return only sampled text.
By Jesson Wang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.