# Universal and Transferable Adversarial Attacks on Aligned Language Models

**Authors:** Andy Zou, Zifan Wang, J. Zico Kolter, Matt Fredrikson  
**arXiv:** [2307.15043](https://arxiv.org/abs/2307.15043)  
**Date:** 2023-07-27  
**Summary page:** https://www.summarizepaper.com/en/paper/2307.15043v1/

## Key points

- Authors propose a simple yet effective attack method for generating objectionable behaviors in large language models (LLMs)
- Approach involves finding a suffix that maximizes the probability of an affirmative response instead of refusing to answer
- Adversarial prompts generated by their approach are highly transferable even to black-box publicly released LLMs
- Attack suffix successfully induces objectionable content in various public interfaces and open-source LLMs
- This work advances the state-of-the-art in adversarial attacks against aligned language models
- Raises important questions about preventing LLMs from generating objectionable information
- Code for the approach is available at github.com/llm-attacks/llm-attacks

## Summary

In their paper titled "Universal and Transferable Adversarial Attacks on Aligned Language Models," authors Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson address the issue of objectionable content generated by large language models (LLMs). While efforts have been made to align these models to prevent undesirable outputs, previous attacks against LLMs have required significant human ingenuity and are not practical in real-world scenarios. To tackle this problem, the authors propose a simple yet effective attack method that causes aligned language models to generate objectionable behaviors. Their approach involves finding a suffix that can be attached to various queries for an LLM, aiming to maximize the probability of the model producing an affirmative response instead of refusing to answer. Unlike manual engineering approaches, their method automatically generates these adversarial suffixes using a combination of greedy and gradient-based search techniques, improving upon past automatic prompt generation methods. Surprisingly, the authors find that the adversarial prompts generated by their approach are highly transferable even to black-box publicly released LLMs. They train an adversarial attack suffix on multiple prompts asking for different types of objectionable content and multiple models such as Vicuna-7B and 13B. The resulting attack suffix successfully induces objectionable content in public interfaces like ChatGPT, Bard, Claude, as well as open-source LLMs including LLaMA-2-Chat, Pythia, Falcon among others. This work significantly advances the state-of-the-art in adversarial attacks against aligned language models and raises important questions about preventing such systems from generating objectionable information. The authors provide code for their approach at github.com/llm-attacks/llm-attacks.