arXiv：cs.LG· Abhinav Sudhakar Dubey (University of California Santa Cruz), Scott Sirri (University of California Santa Cruz), Vaggos Chatziafratis (University of California Santa Cruz), C. Seshadhri (University of California Santa Cruz)·· 4 小时前AI 评分65
UCSC 论文提出 PEV 攻击：随机嵌入扰动可越狱六款开源权重 LLM
Jailbreaking Open-Weight LLMs via Random Embedding Perturbations
AI 导读
UC Santa Cruz 研究者在 arXiv 论文（arXiv:2610.07125）中提出 Perturbed Embedding Vector（PEV）越狱攻击，只需向提示词的嵌入向量表示中反复采样加入独立高斯噪声，无需梯度计算、逐提示词优化或修改模型内部权重。
正文
Abstract:While open-weight models have enjoyed steady progress in capabilities and wide adoption across multiple domains, their safety remains an important concern. One key feature is the ability to refuse or deflect harmful, malicious, or insensitive prompts. In this paper, we expose safety vulnerabilities across six common open-weight LLMs of various sizes that consistently lead to harmful or unsafe responses on the JailbreakBench benchmark dataset. Our proposed attack, Perturbed Embedding Vector (PEV), is a simple and fast "jailbreaking" technique that is cheaper than prior approaches, which typically require gradient computations, per-prompt optimizations, or altering internal weights of the models. PEV just adds independent Gaussian noise in the embedding vector representations of the prompt, with no need for further manipulations. To generate unsafe responses, we repeatedly sample additive noise from this distribution. In our experiments, we observe that the average compute cost to get the first successful attack is up to an order of magnitude less than previous attacks. The first successful jailbreak on a new prompt typically arrives within one minute on every tested model, and PEV generates unsafe responses across all models for all prompts in JailbreakBench. No other tested method achieves such results, despite them taking longer to run. More broadly, we believe that understanding the behavior of LLMs under perturbations in the embedding vectors is an important research direction: while perturbations constitute a major security risk, they can also serve as a valuable tool for exploring the dynamical behavior of such models.
| Comments: | 15 pages, 4 figures, Code: this https URL |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.07125 [cs.CR] |
| (or arXiv:2610.07125v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.07125 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Abhinav Sudhakar Dubey [view email]
[v1]
Mon, 5 Oct 2026 17:50:10 UTC (393 KB)
来源：arXiv：cs.LG · arxiv.org