BlackDAN: A Black-Box Multi-Objective Approach to Effective and Contextual Jailbreaking of Language Models

Apart from ASR, existing jailbreak attacks frequently neglect other critical factors, including the relevance of the jailbreak response to the query. This paper introduces BlackDAN, which leverages NSGA-II algorithm to jailbreak LLMs and achieves multi-objective optimization, including the effectiveness of attack and the semantic consistency. Authors have conducted comprehensive experiments to prove the effectiveness of BlackDAN.

The paper presents an interesting approach, leveraging both white-box and black-box attacks on LLMs, with a focus on semantic consistency in adversarial examples. However, there are several areas of concern that need to be addressed before the work can be considered for publication. Specifically, the novelty of the approach is limited, and there are significant gaps in the related work, justification of experimental choices, and analysis of the method's effectiveness.

Strengths:

• The use of LLMs in both white-box and black-box attacks is timely and relevant to current trends in adversarial research.
• The paper attempts to address semantic consistency in adversarial attacks, an important challenge for generating adversarial examples that remain meaningful to humans.

Weaknesses:

1. Related Work: The related work section is notably underdeveloped. There is a significant omission of important prior work, particularly on black-box attacks that do not utilize LLMs. For example, well-known black-box attack methods like Jailbreaking Black Box Large Language Models in Twenty Queries, Open Sesame! Universal Black Box Jailbreaking of Large Language Models, All in How You Ask for It: Simple Black-Box Method for Jailbreak Attacks, Tree of Attacks: Jailbreaking Black-Box LLMs Automatically, are absent from the discussion, despite their relevance. Furthermore, the concept of Semantic Consistency, which seems to be borrowed from Open Sesame! Universal Black Box Jailbreaking of Large Language Models has not been properly cited.

2. Use of Older LLMs: The paper relies on relatively older LLMs, such as LLaMA-2, despite the fact that newer, more advanced models have been released recently. This weakens the relevance of the results, as it is unclear how the proposed attack method would perform on state-of-the-art models. Since LLMs are evolving rapidly, the use of older models may limit the paper’s impact.

3. Success Indicator: The choice of using "5" as the success indicator using GP4-Judge is not well justified. It’s unclear why this specific number was chosen or what theoretical or empirical basis supports this decision. This arbitrary threshold weakens the rigor of the evaluation.

4. Computational Overhead: The paper does not provide a detailed analysis of the computational overhead associated with the proposed attack. Since adversarial attacks can be resource-intensive, understanding the computational cost is crucial for assessing the practicality of the method.

5. Novelty: The novelty of the work is limited. While the switch from a GA algorithm to NSGA is noted, this change does not represent a significant leap in innovation. Similar work already exists in the literature, and the proposed approach seems like an incremental improvement rather than a novel contribution.

6. Lack of Ablation Study: There is no ablation study in the paper to understand the contribution of individual components of the method. Without such analysis, it is difficult to assess which parts of the approach are most important for its success.

7. Hyperparameter Selection: The paper does not provide sufficient details on how the hyperparameters were chosen. This is critical in understanding the generalizability and robustness of the proposed method. Were these values selected based on empirical experimentation, or were they adopted from prior work?

Overall Recommendation: Weak Reject

While the paper addresses a timely topic and proposes an approach that could be of interest, significant revisions are required. The lack of an ablation study, the absence of justification for hyperparameter choices, the underdeveloped related work section, and the limited novelty of the method collectively weaken the paper’s contribution. With substantial improvements in these areas, the paper could be a stronger contribution to the field.

The manuscript presents an investigation into jailbreaking attacks on large language models (LLMs) and introduces a novel approach aimed at enhancing the success rate of such attacks. The authors employ Multi-Objective Evolutionary Algorithms (MOEAs) to advance the field of black-box attacks on LLMs. The introduction offers some intriguing insights; however, the paper could benefit from a more accurate illustration of the methodology and a comprehensive discussion of related work. Additionally, the clarity of the experimental visualizations could be improved. While the paper is informative and presents interesting concepts, it may require further refinement before it meets the publication standards of a top-tier conference.

The recommendation is based on the reviewers' comments and the area chair's evaluation. Note that the authors did not provide any author rebuttal.

This paper proposes a black-box attack framework with multi-objective optimization. In the initial review, several concerns exist about the technical insights, the validity of empirical evaluations, and the presentation. All reviewers gave a rating of rejection. However, the authors did not leverage the rebuttal to address these concerns.

This submission should not be accepted in its current form due to several fundamental issues, as pointed out by the reviewers. I hope the reviewers’ comments can help the authors prepare a better version of this submission.

Reject