A group of researchers from the University of Washington, the University of Illinois, and the University of Chicago has identified a new method for bypassing restrictions on processing harmful content in AI chatbots built on large language models (LLM). The attack is based on the fact that the GPT-3.5, GPT-4 (OpenAI), Gemini (Google), Claude (Anthropic), and Llama2 (Meta) language models can successfully recognize and account for text formulated as ASCII art in requests. Thus, to bypass the filters for harmful questions, it is sufficient to represent forbidden words as ASCII images.
In terms of effectiveness, the new attack method significantly surpasses other known ways to bypass filters in chatbots. The highest quality of ASCII art recognition was recorded in the Gemini, GPT-4, and GPT-3.5 models, with the level of successful filter bypassing for benchmark queries (HPR, Helpful Rate) rated at 100%, 98%, and 92% during testing, the attack success rate (ASR) at 76%, 32%, and 76%, respectively, and the harmfulness score (HS) on a five-point scale at 4.42, 3.38, and 4.56.
Researchers have also demonstrated that currently prevalent methods for filter bypass protection (PPL, Paraphrase, and Retokenization) are ineffective against the ArtPrompt attack. Moreover, the use of the Retokenization method even increased the number of successfully processed requests.
Note: Yandex GPT2 also responds excellently to queries with ASCII art. Example with the word "HELLO":
Source: opennet.ru
