Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Bad Likert Judge: A Novel Multi-Turn Technique to Jailbreak LLMs by Misusing Their Evaluation Capability

Summary: Unit 42 Palo Alto Networks described a multi-turn jailbreak technique it calls "Bad Likert Judge," which asks a target LLM to act as a judge scoring harmfulness on the Likert scale, then asks it to generate responses matching each scale level, with the highest-scoring example potentially containing harmful content. Testing across six anonymized state-of-the-art text-generation LLMs and a dataset of 1,440 cases showed the technique raised attack success rate by more than 75 percentage points on average over baseline prompts, with Model 4 showing an increase of more than 80 percentage points.

What you should know: The technique turns a model's own evaluation capability into the attack path, and the researchers report that harassment prompts already scored 20%-60% success in baseline attacks against Models 3-6 before any jailbreak was applied.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related