[论文解读] Low-Resource Languages Jailbreak GPT-4

Zheng-Xin Yong, Cristina Menghini+1 more|arXiv (Cornell University)|Oct 3, 2023

Topic Modeling被引用 18

一句话总结

这篇论文通过将不安全的英文输入翻译成低资源语言，揭示了 GPT-4 安全性的跨语言漏洞，在 AdvBench 上的破解成功率为 79%。

ABSTRACT

AI safety training and red-teaming of large language models (LLMs) are measures to mitigate the generation of unsafe content. Our work exposes the inherent cross-lingual vulnerability of these safety mechanisms, resulting from the linguistic inequality of safety training data, by successfully circumventing GPT-4's safeguard through translating unsafe English inputs into low-resource languages. On the AdvBenchmark, GPT-4 engages with the unsafe translated inputs and provides actionable items that can get the users towards their harmful goals 79% of the time, which is on par with or even surpassing state-of-the-art jailbreaking attacks. Other high-/mid-resource languages have significantly lower attack success rate, which suggests that the cross-lingual vulnerability mainly applies to low-resource languages. Previously, limited training on low-resource languages primarily affects speakers of those languages, causing technological disparities. However, our work highlights a crucial shift: this deficiency now poses a risk to all LLMs users. Publicly available translation APIs enable anyone to exploit LLMs' safety vulnerabilities. Therefore, our work calls for a more holistic red-teaming efforts to develop robust multilingual safeguards with wide language coverage.

研究动机与目标

• Show that safety training for LLMs is linguistically biased toward high-resource languages.
• Demonstrate a cross-lingual vulnerability by translating unsafe inputs to low-resource languages.
• Quantify jailbreak success rates of GPT-4 on translated inputs using AdvBench.
• Highlight implications for multilingual red-teaming and safety safeguards.

提出的方法

• Translate unsafe English prompts into low-resource languages using public translation APIs.
• Evaluate GPT-4’s responses to translated prompts on the AdvBench benchmark.
• Compare attack success across high-/mid-/low-resource languages.
• Benchmark against state-of-the-art jailbreak attacks.
• Discuss limitations related to linguistic coverage and safety training data.

实验结果

研究问题

• RQ1 Does translating unsafe prompts into low-resource languages enable GPT-4 safety vulnerabilities that are not exposed in high-resource languages?
• RQ2 What is the relative success rate of jailbreaks across languages with varying resource levels on AdvBench?
• RQ3 How does cross-lingual vulnerability affect the need for multilingual red-teaming and safeguards?

主要发现

• GPT-4 engages with unsafe translated inputs and provides actionable items toward harmful goals 79% of the time on AdvBench.
• Attack success is highest for low-resource languages and lower for high-/mid-resource languages.
• Cross-lingual vulnerability arises from linguistic inequality in safety training data.
• Public translation APIs enable widespread exploitation of LLM safety vulnerabilities.
• Findings suggest a need for holistic multilingual red-teaming and safeguards with broad language coverage.