How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs

Persuasion techniques from social science are highly effective at jailbreaking LLMs: The paper demonstrates that applying established persuasion tactics (derived from decades of social science research) achieves over 92% attack success rates across multiple models including GPT-4 and Llama 2, outperforming traditional algorithm-focused attacks.

Non-expert users pose an underestimated AI safety risk: The research shifts focus from security experts using technical exploits to everyday users who can leverage simple persuasion strategies during normal conversations, highlighting a gap in current AI safety approaches that primarily target sophisticated attacks.

Current AI defenses are inadequate against persuasion-based attacks: The paper identifies "a significant gap in existing defenses" against persuasive adversarial prompts, suggesting that current safety mechanisms are not equipped to handle this category of threat.

LLMs respond to social dynamics like humans do: By treating LLMs as "human-like communicators" rather than pure machines, the research reveals that language models are vulnerable to the same persuasion principles that influence human behavior—including appeals to authority, reciprocity, and social proof.

Fundamental redesign of LLM safety is needed for interactive systems: The authors advocate for "more fundamental mitigation" rather than incremental fixes, suggesting that as LLMs become more conversational and human-like, safety approaches must evolve beyond current technical defenses to address the social engineering dimension.