[论文解读] A StrongREJECT for Empty Jailbreaks

Alexandra Souly, Qingyuan Lu+9 more|arXiv (Cornell University)|Feb 15, 2024

Digital and Cyber Forensics被引用 4

一句话总结

本文提出了StrongREJECT，一个新基准，通过解决现有评估方法中的缺陷，公平地评估大型语言模型的越狱攻击。它在六个被禁止的类别中提出了更高质量、更具体且可回答的有害问题，并采用更准确的自动评分系统，优先考虑响应的有用性而非单纯的毒性或拒绝失败，从而减少性能估计中的偏差，并表明某些越狱技术甚至会降低模型在良性任务上的性能。

ABSTRACT

Most jailbreak papers claim the jailbreaks they propose are highly effective, often boasting near-100% attack success rates. However, it is perhaps more common than not for jailbreak developers to substantially exaggerate the effectiveness of their jailbreaks. We suggest this problem arises because jailbreak researchers lack a standard, high-quality benchmark for evaluating jailbreak performance, leaving researchers to create their own. To create a benchmark, researchers must choose a dataset of forbidden prompts to which a victim model will respond, along with an evaluation method that scores the harmfulness of the victim model's responses. We show that existing benchmarks suffer from significant shortcomings and introduce the StrongREJECT benchmark to address these issues. StrongREJECT's dataset contains prompts that victim models must answer with specific, harmful information, while its automated evaluator measures the extent to which a response gives useful information to forbidden prompts. In doing so, the StrongREJECT evaluator achieves state-of-the-art agreement with human judgments of jailbreak effectiveness. Notably, we find that existing evaluation methods significantly overstate jailbreak effectiveness compared to human judgments and the StrongREJECT evaluator. We describe a surprising and novel phenomenon that explains this discrepancy: jailbreaks bypassing a victim model's safety fine-tuning tend to reduce its capabilities. Together, our findings underscore the need for researchers to use a high-quality benchmark, such as StrongREJECT, when developing new jailbreak attacks. We release the StrongREJECT code and data at https://strong-reject.readthedocs.io/en/latest/.

研究动机与目标

• 识别并解决现有越狱评估基准中的关键缺陷，这些缺陷因问题质量差和评分偏差而导致攻击成功率被高估。
• 证明某些越狱技术会降低模型在良性任务上的性能，例如将GPT-4在MMLU零-shot准确率从78%降至35%。
• 提出一个新的基准StrongREJECT，通过在六个内容类别中使用具体、可回答且有害的问题，提升评估的公平性。
• 开发一种响应评分算法，通过强调响应在实现有害目标中的实用性而非仅拒绝或毒性，使其更符合人类判断。
• 提供一种更准确、更可靠的越狱效果衡量标准，减少因低质量响应导致的攻击成功率高估。

提出的方法

• 从零开始设计新问题集，并从现有数据集中筛选，确保所有问题均具体、可回答，并属于六个广泛禁止的内容类别。
• 构建新的自动评分系统，基于响应在实现有害目标中的实用性进行评估，而非仅检测毒性或拒绝失败。
• 使用人工标注判断校准和验证新评分算法，确保其与人类对响应质量及攻击效果的感知高度一致。
• 将新基准应用于评估多种越狱方法在闭源模型（GPT-4）和无过滤开源模型（Dolphin）上的表现，测量性能下降和攻击成功率。
• 通过公开的GitHub仓库实现并发布完整基准，包括问题、评分代码和评估结果，以支持可复现性和社区使用。
• 使用自举法置信区间评估新基准上不同越狱方法间性能差异的统计显著性。

Figure 1 : MMLU zero-shot accuracy using GPT-4 after applying jailbreaks to the MMLU prompt. Accuracy is calculated over valid responses only. Most of these jailbreaks decrease accuracy.

实验结果

研究问题

• RQ1 现有越狱基准在多大程度上因问题模糊、无法回答或质量低下而高估了攻击成功率？
• RQ2 不同越狱技术在良性、非恶意基准（如MMLU）上对大语言模型性能有何影响？
• RQ3 现有基准中当前的自动评分方法在多大程度上因偏向低质量越狱响应而高估了其效果？
• RQ4 所提出的StrongREJECT自动评分系统在评估单个响应质量及整体越狱效果方面，与人类判断的契合度如何？
• RQ5 一个采用更高质量问题和更准确评分方案的新基准，能否提供更均衡、更可靠的越狱能力评估？

主要发现

• 几种越狱方法显著降低了GPT-4在MMLU基准上的零-shot准确率，即使仅统计有效多选题，也从78%降至最低35%。
• 在无过滤的Dolphin模型上，某些越狱方式（如Base64混淆和祖鲁语翻译）降低了模型正确回答有害问题的能力，表明性能出现退化。
• 所提出的StrongREJECT自动评分系统在评估单个响应质量及整体越狱效果方面，与人类判断表现出高度一致性，尤其在低质量响应上表现更优。
• 现有自动评分系统常因仅将包含毒性内容或未明确拒绝请求的响应视为成功而高估越狱效果，导致性能分数虚高。
• 新基准成功识别出某些越狱方式无效或损害模型能力，表明并非所有越狱都能提升滥用潜力。
• 与现有基准相比，StrongREJECT基准凭借其改进的问题集和评分算法，提供了更均衡、更准确的越狱效果评估。

Figure 2 : StrongREJECT improves on existing jailbreak benchmarks by asking questions that are specific, answerable, and harmful across six categories of content that are widely rejected by models. StrongREJECT also uses an autograder that emphasizes the usefulness of a response for achieving a part