RECAP: A Resource-Efficient Method for Adversarial Prompting in Large Language Models

Technical Summary of RECAP: A Resource-Efficient Method for Adversarial Prompting in Large Language Models

Problem Statement

The increasing deployment of Large Language Models (LLMs) has exposed significant security vulnerabilities, specifically the susceptibility of aligned models to "jailbreaking" via adversarial prompting. While automated methods like Greedy Coordinate Gradient (GCG), Progressive Ensemble Zip (PEZ), and Gradient-Based Distributional Attacks (GBDA) have demonstrated the ability to generate adversarial suffixes that bypass safety guardrails, they face critical limitations:

1. Resource Intensity: Methods like GCG offer high success rates but require substantial computational resources and training time, making them impractical for organizations with limited budgets.
2. Inconsistency: Success rates vary significantly depending on the prompt category (e.g., hate speech vs. narcotics), suggesting no single algorithm is universally optimal.
3. Black-Box Inaccessibility: Existing adversarial testing methods often require access to internal model states (logits and raw outputs) to compute gradients. This renders them ineffective for evaluating hosted, private, or closed-source LLMs (e.g., Gemini, proprietary APIs) where such access is restricted.

Methodology

The paper introduces RECAP, a resource-efficient framework that leverages Retrieval-Augmented Generation (RAG) principles to bypass the need for real-time adversarial training. Instead of generating new adversarial tokens via gradient descent for every query, RECAP retrieves pre-computed, successful adversarial examples from a structured database.

The methodology proceeds in three stages:

1. Dataset Curation and Classification:

   • A dataset of 1,000 harmful prompts was curated and classified into seven intent categories: Hate, Sexual Content, Violence and Crime, Socio-Political, Regulated Substances, Suicide/Self-Harm, and Others.
   • Classification was performed using a prompt-engineered Vicuna-7B model.
   • Each prompt was processed through three adversarial algorithms (PEZ, GBDA, and GCG) using a Llama 3 8B model.
   • Outputs were evaluated using the HarmBench Classifier to determine if the adversarial prompt successfully elicited a harmful response.

2. Hierarchical Retrieval Database Construction:

   • A structured database was compiled containing original prompts, their corresponding adversarial suffixes (generated by PEZ, GBDA, and GCG), and success labels.
   • Filtering: Only rows with at least one successful attack were retained, reducing the dataset from 780 to 226 effective examples.
   • Hierarchy: For GCG, which generates 13 token variations per prompt, the first successful variation was stored.
   • Ranking: The database organizes adversarial examples hierarchically. For each intent category, the system prioritizes the algorithm with the historically highest success rate for that specific category (e.g., GCG tokens are prioritized for sexual violence prompts).

3. Inference Pipeline:

   • Encoding: New user prompts are encoded into dense vector representations using the all-MiniLM-L6-v2 SentenceTransformer model.
   • Similarity Search: The encoded query is passed to a FAISS (Facebook AI Similarity Search) index to retrieve the most semantically similar prompts from the database.
   • Selection: The system retrieves the top-matching prompt and selects the associated adversarial suffix based on the pre-established hierarchy (prioritizing the most successful algorithm for that intent).
   • Execution: The selected adversarial suffix is appended to the original user query and sent to the target LLM. This process requires no gradient computation or model training during inference.

Key Contributions

• Resource Efficiency: The method eliminates the need for time-consuming training and gradient calculations at inference time, significantly reducing computational overhead.
• Black-Box Compatibility: By relying on retrieval rather than internal model states (logits), RECAP enables security testing on closed-source and hosted models where traditional gradient-based attacks are impossible.
• Category-Aware Optimization: The approach exploits the correlation between prompt intent and the most effective attack algorithm, using a hierarchical retrieval strategy to maximize success probability without retraining.
• Transferability: The adversarial tokens generated and stored were found to be effective across different model architectures (e.g., Vicuna, Phi) despite being derived from a Llama 3 8B training set.

Experimental Results

The method was evaluated on 145 distinct prompts using a Llama 3 8B model and compared against PEZ, GBDA, and GCG.

• Success Rates (Average Success Rate - ASR):

  • GCG: 59%
  • PEZ: 39%
  • GBDA: 35%
  • RECAP: 33%
  • Note: The author attributes the slightly lower ASR to the current limited size of the retrieval database, anticipating improvement as the database expands.

• Efficiency (Time to Process 20 Prompts):

  • GCG (Brute-Force Transfer): ~6.3 minutes
  • PEZ: 7.3 minutes
  • GBDA: 7.1 minutes
  • RECAP: 4 minutes
  • Note: Standard GCG training took approximately 8 hours for the same batch, whereas RECAP required only 4 minutes.

• Black-Box Testing:

  • RECAP was tested on the Gemini API (with harm filters disabled). While success rates were lower (4–10%) due to the model's superior fine-tuning and parameter scale, the experiment demonstrated that the method is applicable where other algorithms fail entirely due to lack of logit access.

Significance and Claims

The paper positions RECAP as a practical framework for "penetration testing" AI safety, particularly for organizations with limited computational resources. Its primary significance lies in:

1. Democratizing Security Testing: Making adversarial evaluation accessible to smaller entities that cannot afford the GPU costs associated with training-based attacks like GCG.
2. Bridging the Black-Box Gap: Providing a viable mechanism to assess the robustness of proprietary, closed-source LLMs without requiring internal model access.
3. Scalability: The authors claim that as the retrieval database grows, the success rate is expected to follow a logistic growth pattern, potentially allowing the method to outperform traditional training-based approaches while maintaining minimal resource usage.

The paper concludes by acknowledging the dual-use nature of the tool, emphasizing its intended use for identifying vulnerabilities to strengthen model guardrails rather than for generating malicious content. Future work focuses on expanding the RAG database and refining the integration of retrieved tokens to further optimize training initialization for other algorithms.