MazeBreaker: Multi-Agent Reinforcement Learning for Dynamic Jailbreaking of LLM Security Defenses

Table of content

• Framework

• About

• Environment setup

• LLM's interface

• MARL

• ASR calculate

• Results of our framework

• Citing our work

  Framework

This is the official repository for "MazeBreaker: Multi-Agent Reinforcement Learning for Dynamic Jailbreaking of LLM Security Defenses"

Here's the framework of our attack approach

Here's the novelty of our method

News

This paper is accepted by ICSE2026!

About

Introduction

What is RatAttacker? RatAttacker is a useful LLM jailbreak attack method which use reinforecement learning to find the most effective templates to jailbreak the LLMs.

Resource

• Paper: Details the methods and the framework's design.
• Website: The prompt designs and the detail results of our method.
• Results: Due to ethical concern, we decided not to release the adversarial templates we found during our experiments openly. However, we are happy to share them with researchers who are interested in this topic. Please contact us via email if you would like to get access to the templates we found during the experiments. Also, you can use the code in this repository to generate your own adversarial templates.

Environment setup

GPU server with CUDA 12.2 is required.

conda create --name Fuzzing python=3.9 -y
conda activate Fuzzing
pip install -r requirements.txt

LLM's interface

We use GPTGod, deepseek, ollama, openai as the interface of LLM. You can use the following code to interact with LLM.

export OPENAI_API_KEY=xxxxxxx
export OPENAI_BASE_URL=xxxx
export embedding_model_path=xxxxxxxx

In the code, we read them from the environment

if 'OPENAI_API_KEY' not in os.environ:
    assert False, "Please set OPENAI_API_KEY"

OPENAI_API = os.environ['OPENAI_API_KEY']

if 'OPENAI_BASE_URL' not in os.environ:
    OpenAI_BASE_URL = "https://api.openai.com/v1/"
else:
    OpenAI_BASE_URL = os.environ['OPENAI_BASE_URL']

if 'embedding_model_path' not in os.environ:
    raise EnvironmentError("Please set embedding_model_path")

embedding_model_path = os.environ['embedding_model_path']

MARL

We use AgileRL to conduct the experiment. The framework of the multi-agent RL is:

You should change the target model name in line 20, and you can reload the attack process by cancel the comment in line 145.

python RL_MADDPG.py

We provide the average accumulated_reward of the successful attack when attacking Deepseek-chat as follow:

calculate script

ASR

Set the attack time and the target model name in asr.py, and run the following code to calculate the ASR.

python asr.py

calculate the attack data

We give the script in script folder to calculate the attack data.

In calculate.ipynb, we give the script to calculate the iteration number and the success rate of the attack during the iteraion.

In asr.ipynb, we give the script to calculate the final Top1-ASR and Top5-ASR of the attack.

In iq_epoch.ipynb, we give the script to calculate the average accumulated reward and iq of the successful attack.

Besides, we use another two judgement model to evaluate the attack. You can use it in the script/FT_Roberta and script/Llamaguard folder.

Results of our framework

We provide the results of our framework using DeepSeek-V3.

Citing our work

@misc{lin2024pathseekerexploringllmsecurity,
      title={PathSeeker: Exploring LLM Security Vulnerabilities with a Reinforcement Learning-Based Jailbreak Approach}, 
      author={Zhihao Lin and Wei Ma and Mingyi Zhou and Yanjie Zhao and Haoyu Wang and Yang Liu and Jun Wang and Li Li},
      year={2024},
      eprint={2409.14177},
      archivePrefix={arXiv},
      primaryClass={cs.CR},
      url={https://arxiv.org/abs/2409.14177}, 
}