Using Mechanistic Interpretability to Craft Adversarial Attacks against Large Language Models
This work addresses the need for more efficient and effective adversarial attacks in AI security, offering a novel approach that bridges interpretability and practical applications, though it is incremental in combining existing techniques.
The paper tackles the problem of efficiently crafting adversarial attacks on large language models by using mechanistic interpretability to identify acceptance subspaces and reroute embeddings, achieving attack success rates of 80-95% on models like Gemma2 and Llama3.2 within minutes or seconds.
Traditional white-box methods for creating adversarial perturbations against LLMs typically rely only on gradient computation from the targeted model, ignoring the internal mechanisms responsible for attack success or failure. Conversely, interpretability studies that analyze these internal mechanisms lack practical applications beyond runtime interventions. We bridge this gap by introducing a novel white-box approach that leverages mechanistic interpretability techniques to craft practical adversarial inputs. Specifically, we first identify acceptance subspaces - sets of feature vectors that do not trigger the model's refusal mechanisms - then use gradient-based optimization to reroute embeddings from refusal subspaces to acceptance subspaces, effectively achieving jailbreaks. This targeted approach significantly reduces computation cost, achieving attack success rates of 80-95\% on state-of-the-art models including Gemma2, Llama3.2, and Qwen2.5 within minutes or even seconds, compared to existing techniques that often fail or require hours of computation. We believe this approach opens a new direction for both attack research and defense development. Furthermore, it showcases a practical application of mechanistic interpretability where other methods are less efficient, which highlights its utility. The code and generated datasets are available at https://github.com/Sckathach/subspace-rerouting.