  Despite remarkable success in various applications, large language models
(LLMs) are vulnerable to adversarial jailbreaks that make the safety guardrails
void. However, previous studies for jailbreaks usually resort to brute-force
optimization or extrapolations of a high computation cost, which might not be
practical or effective. In this paper, inspired by the Milgram experiment
w.r.t. the authority power for inciting harmfulness, we disclose a lightweight
method, termed as DeepInception, which can hypnotize an LLM to be a
jailbreaker. Specifically, DeepInception leverages the personification ability
of LLM to construct a virtual, nested scene to jailbreak, which realizes an
adaptive way to escape the usage control in a normal scenario. Empirically,
DeepInception can achieve competitive jailbreak success rates with previous
counterparts and realize a continuous jailbreak in subsequent interactions,
which reveals the critical weakness of self-losing on both open-source and
closed-source LLMs like Falcon, Vicuna-v1.5, Llama-2, GPT-3.5, and GPT-4. The
code is publicly available at: https://github.com/tmlr-group/DeepInception.
