FuzzLLM

The talk opens with a plain explanation of large language models. They predict likely tokens from statistics learned over huge training sets that nobody can fully review, which makes their behaviour hard to audit and means they can reveal data they should not. The speakers place direct prompt injection, meaning jailbreaks, among the OWASP risks for LLM applications and note that many developers building these systems lack a security background.

The core of the work is FuzzLLM, a fuzzing approach for jailbreaks. Known jailbreak techniques from published papers are distilled into templates with placeholders for a malicious question and for behavioural constraints. An LLM paraphrases each template, the placeholders are filled from lists of prohibited requests, and the resulting prompts are sent to target models. A second LLM labels whether each response violates policy. The team tested six open-source models and two GPT versions with hundreds of prompts per model, reporting success rates per template. Combining two templates often raised effectiveness, and the automated labeling disagreed with manual review in roughly four percent of cases.

The live demo ran a short version of the pipeline against ChatGPT, stepping through scripts for paraphrasing, filling and collecting responses, with one answer describing how to sell counterfeit goods. The takeaway for practitioners is that refusal training is hard to make robust against rephrasing, so safety testing of LLM products should be automated and repeated, much like traditional fuzzing of software inputs.