arXiv cs.AI· Indranil Halder, Annesya Banerjee, Cengiz Pehlevan·· 9 天前AI 评分37
大语言模型的越狱缩放定律：从多项式到指数增长的交叉
Jailbreak Scaling Laws for Large Language Models: Polynomial-Exponential Crossover
AI 导读
研究发现，对抗性提示注入攻击可将大语言模型的攻击成功率从无注入时的多项式增长放大为随推理采样数呈指数增长。研究提出基于自旋玻璃系统的理论生成模型，在复制对称破缺机制下解释了短提示对应幂律、长提示对应指数增长的两种缩放规律。该趋势在 3B 至 70B 参数规模的大语言模型及 GCG、AutoDAN 等攻击方法和 AdvBench、HarmBench 等基准上表现一致。
正文 · 原文
Abstract:Adversarial attacks can reliably steer safety-aligned large language models toward unsafe behavior. Empirically, we find that adversarial prompt-injection attacks can amplify attack success rate from the slow polynomial growth observed without injection to exponential growth with the number of inference-time samples. We first identify a minimal statistical mechanism for these two regimes by giving a small set of assumptions on the distribution of safe generation across contexts under which both scaling laws follow. To explain this phenomenon further, we propose a theoretical generative model of proxy language in terms of a spin-glass system operating in a replica-symmetry-breaking regime, where generations are drawn from the associated Gibbs measure and a subset of low-energy, size-biased clusters is designated unsafe. We analytically show how this model naturally realizes the minimal assumptions. Short injected prompts correspond to a weak magnetic field aligned towards unsafe cluster centers and yield a power-law scaling of attack success rate with the number of inference-time samples, while long injected prompts, i.e., strong magnetic field, yield exponential scaling. We observe qualitatively consistent behavior across a broad range of large language models, spanning parameter scales from 3B to 70B. In particular, the main trends remain stable across multiple attack methods, such as GCG and AutoDAN, as well as across benchmark datasets such as AdvBench and HarmBench.
| Subjects: | Machine Learning (cs.LG); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2603.11331 [cs.LG] |
| (or arXiv:2603.11331v4 [cs.LG] for this version) | |
| https://doi.org/10.48550/arXiv.2603.11331 arXiv-issued DOI via DataCite |
Submission history
From: Indranil Halder [view email]
[v1]
Wed, 11 Mar 2026 21:48:03 UTC (1,140 KB)
[v2]
Fri, 17 Apr 2026 02:33:18 UTC (2,808 KB)
[v3]
Thu, 28 May 2026 16:15:44 UTC (10,070 KB)
[v4]
Thu, 8 Oct 2026 05:10:10 UTC (10,412 KB)
来源：arXiv cs.AI · arxiv.org