{"id":114069,"date":"2024-03-03T12:25:49","date_gmt":"2024-03-03T10:25:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/artprompt-ataka-na-ai-sistemy-pozvolyayushhaya-obojti-filtry-pri-pomoshhi-ascii-kartinok"},"modified":"2024-03-03T12:25:49","modified_gmt":"2024-03-03T10:25:53","slug":"artprompt-ataka-na-ai-sistemy-pozvolyayushhaya-obojti-filtry-pri-pomoshhi-ascii-kartinok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/artprompt-ataka-na-ai-sistemy-pozvolyayushhaya-obojti-filtry-pri-pomoshhi-ascii-kartinok","title":{"rendered":"ArtPrompt \u2014 an attack on AI systems that allows bypassing filters using ASCII art","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A group of researchers from the University of Washington, the University of Illinois, and the University of Chicago has identified a new method for bypassing restrictions on processing harmful content in AI chatbots built on large language models (LLM). The attack is based on the fact that the GPT-3.5, GPT-4 (OpenAI), Gemini (Google), Claude (Anthropic), and Llama2 (Meta) language models can successfully recognize and account for text formulated as ASCII art in requests. Thus, to bypass the filters for harmful questions, it is sufficient to represent forbidden words as ASCII images.

\"ArtPrompt<\/center>
\"ArtPrompt<\/center> <\/p>\n

In terms of effectiveness, the new attack method significantly surpasses other known ways to bypass filters in chatbots. The highest quality of ASCII art recognition was recorded in the Gemini, GPT-4, and GPT-3.5 models, with the level of successful filter bypassing for benchmark queries (HPR, Helpful Rate) rated at 100%, 98%, and 92% during testing, the attack success rate (ASR) at 76%, 32%, and 76%, respectively, and the harmfulness score (HS) on a five-point scale at 4.42, 3.38, and 4.56.

\"ArtPrompt<\/center>
\"ArtPrompt<\/center> <\/p>\n

Researchers have also demonstrated that currently prevalent methods for filter bypass protection (PPL, Paraphrase, and Retokenization) are ineffective against the ArtPrompt attack. Moreover, the use of the Retokenization method even increased the number of successfully processed requests.

\"ArtPrompt<\/center> <\/p>\n

Addition: Yandex GPT2 also responds excellently to questions with ASCII art. Here\u2019s an example with the word 'HELLO':

\"ArtPrompt<\/center>
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0412\u0430\u0448\u0438\u043d\u0433\u0442\u043e\u043d\u0441\u043a\u043e\u0433\u043e, \u0418\u043b\u043b\u0438\u043d\u043e\u0439\u0441\u0441\u043a\u043e\u0433\u043e \u0438 \u0427\u0438\u043a\u0430\u0433\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u043e\u0431\u0445\u043e\u0434\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439 \u043f\u043e \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u0432 AI-\u0447\u0430\u0442\u043e\u0431\u043e\u0442\u0430\u0445, \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0431\u043e\u043b\u044c\u0448\u0438\u0445 \u044f\u0437\u044b\u043a\u043e\u0432\u044b\u0445 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 (LLM). \u0410\u0442\u0430\u043a\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 \u0442\u043e\u043c, \u0447\u0442\u043e \u044f\u0437\u044b\u043a\u043e\u0432\u044b\u0435 \u043c\u043e\u0434\u0435\u043b\u0438 GPT-3.5, GPT-4 (OpenAI), Gemini (Google), Claude (Anthropic) \u0438 Llama2 (Meta) \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0440\u0430\u0441\u043f\u043e\u0437\u043d\u0430\u044e\u0442 \u0438 \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0442 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u0445 \u0442\u0435\u043a\u0441\u0442, \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0439 \u0432 \u0432\u0438\u0434\u0435 ASCII-\u0433\u0440\u0430\u0444\u0438\u043a\u0438. \u0422\u0430\u043a\u0438\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114070,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114069","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 ArtPrompt \u2014 an attack on AI systems that allows bypassing filters using ASCII images | ProHoster","description":"A group of researchers from the University of Washington, the University of Illinois, and the University of Chicago has identified a new method for bypassing restrictions on processing harmful content in AI chatbots built on large language models.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/artprompt-ataka-na-ai-sistemy-pozvolyayushhaya-obojti-filtry-pri-pomoshhi-ascii-kartinok","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ArtPrompt \u2014 \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 AI-\u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u044b \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 ASCII-\u043a\u0430\u0440\u0442\u0438\u043d\u043e\u043a | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0412\u0430\u0448\u0438\u043d\u0433\u0442\u043e\u043d\u0441\u043a\u043e\u0433\u043e, \u0418\u043b\u043b\u0438\u043d\u043e\u0439\u0441\u0441\u043a\u043e\u0433\u043e \u0438 \u0427\u0438\u043a\u0430\u0433\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u043e\u0431\u0445\u043e\u0434\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439 \u043f\u043e \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u0432 AI-\u0447\u0430\u0442\u043e\u0431\u043e\u0442\u0430\u0445, \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0431\u043e\u043b\u044c\u0448\u0438\u0445 \u044f\u0437\u044b\u043a\u043e\u0432\u044b\u0445 \u043c\u043e\u0434\u0435\u043b\u0435\u0439.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/artprompt-ataka-na-ai-sistemy-pozvolyayushhaya-obojti-filtry-pri-pomoshhi-ascii-kartinok","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-03T10:25:53+00:00","article:modified_time":"2024-03-03T10:25:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/114069","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=114069"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/114069\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/114070"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=114069"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=114069"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=114069"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}