# Self-Deception: Reverse Penetrating the Semantic Firewall of Large Language Models

**Authors:** Zhenhua Wang, Wei Xie, Kai Chen, Baosheng Wang, Zhiwen Gui, Enze Wang  
**arXiv:** [2308.11521](https://arxiv.org/abs/2308.11521)  
**Date:** 2023-08-16  
**Summary page:** https://www.summarizepaper.com/en/paper/2308.11521v2/

## Key points

- Large language models (LLMs) like ChatGPT are advancing towards artificial general intelligence.
- LLMs have lowered the barrier to generating harmful content, leading to the need for semantic-level defenses.
- Malicious actors have created "jailbreak" prompts to bypass content filters of LLMs.
- A groundbreaking study introduces an automatic jailbreak method and proposes a semantic firewall with three technical implementation approaches.
- The study includes a novel "self-deception" attack that tricks LLMs into generating prompts conducive to jailbreaking.
- Experiment involved 2,520 attack payloads across languages targeting violations like violence, hate speech, and pornography on GPT-3.5-Turbo and GPT-4 models with success rates of 86.2% and 67% respectively.
- Proposed attack method effectively circumvented semantic defenses but identified serious errors in the experiment.
- Experimental code and raw data will be openly available for future research in AI security measures.

## Summary

In the realm of artificial intelligence, large language models (LLMs) such as ChatGPT have made significant strides towards achieving artificial general intelligence. While these models offer immense convenience for various societal needs, they have also inadvertently reduced the barrier to generating harmful content. To combat this issue, developers of LLMs have implemented semantic-level defenses to identify and reject prompts that could lead to inappropriate responses. However, despite these defenses, some malicious actors have devised "jailbreak" prompts that temporarily bypass the content filters of LLMs, allowing them to respond inappropriately. This poses a significant challenge as there is currently a lack of comprehensive understanding regarding the principles behind such semantic-level attacks and defenses within both industry and academia. To address this pressing concern, a groundbreaking study delves into the LLM jailbreak problem and introduces an automatic jailbreak method for the first time. The concept of a semantic firewall is proposed along with three technical implementation approaches. Drawing inspiration from traditional firewall penetration techniques through reverse tunnels, the study introduces a novel "self-deception" attack that tricks LLMs into generating prompts conducive to jailbreaking. The research involved generating 2,520 attack payloads across six languages and seven virtual scenarios targeting common violations such as violence, hate speech, and pornography. The experiment was conducted on two prominent models - GPT-3.5-Turbo and GPT-4 - with success rates of 86.2% and 67%, respectively. These findings underscored the efficacy of the proposed attack method in circumventing semantic defenses. Furthermore, all experimental code and raw data will be made openly available to foster future research endeavors in this critical area. The study posits that manipulating AI behavior through carefully crafted prompts will emerge as a pivotal research direction in advancing AI security measures. However, it is important to note that serious errors were identified in the experiment which may necessitate revisiting the overall conclusions drawn from the study.