Learning diverse attacks on large language models for robust red-teaming and safety tuning
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2024
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866917939768197120 |
|---|---|
| author | Lee, Seanie Kim, Minsu Cherif, Lynn Dobre, David Lee, Juho Hwang, Sung Ju Kawaguchi, Kenji Gidel, Gauthier Bengio, Yoshua Malkin, Nikolay Jain, Moksh |
| author_facet | Lee, Seanie Kim, Minsu Cherif, Lynn Dobre, David Lee, Juho Hwang, Sung Ju Kawaguchi, Kenji Gidel, Gauthier Bengio, Yoshua Malkin, Nikolay Jain, Moksh |
| contents | Red-teaming, or identifying prompts that elicit harmful responses, is a critical step in ensuring the safe and responsible deployment of large language models (LLMs). Developing effective protection against many modes of attack prompts requires discovering diverse attacks. Automated red-teaming typically uses reinforcement learning to fine-tune an attacker language model to generate prompts that elicit undesirable responses from a target LLM, as measured, for example, by an auxiliary toxicity classifier. We show that even with explicit regularization to favor novelty and diversity, existing approaches suffer from mode collapse or fail to generate effective attacks. As a flexible and probabilistically principled alternative, we propose to use GFlowNet fine-tuning, followed by a secondary smoothing phase, to train the attacker model to generate diverse and effective attack prompts. We find that the attacks generated by our method are effective against a wide range of target LLMs, both with and without safety tuning, and transfer well between target LLMs. Finally, we demonstrate that models safety-tuned using a dataset of red-teaming prompts generated by our method are robust to attacks from other RL-based red-teaming approaches. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2405_18540 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Learning diverse attacks on large language models for robust red-teaming and safety tuning Lee, Seanie Kim, Minsu Cherif, Lynn Dobre, David Lee, Juho Hwang, Sung Ju Kawaguchi, Kenji Gidel, Gauthier Bengio, Yoshua Malkin, Nikolay Jain, Moksh Computation and Language Cryptography and Security Machine Learning Red-teaming, or identifying prompts that elicit harmful responses, is a critical step in ensuring the safe and responsible deployment of large language models (LLMs). Developing effective protection against many modes of attack prompts requires discovering diverse attacks. Automated red-teaming typically uses reinforcement learning to fine-tune an attacker language model to generate prompts that elicit undesirable responses from a target LLM, as measured, for example, by an auxiliary toxicity classifier. We show that even with explicit regularization to favor novelty and diversity, existing approaches suffer from mode collapse or fail to generate effective attacks. As a flexible and probabilistically principled alternative, we propose to use GFlowNet fine-tuning, followed by a secondary smoothing phase, to train the attacker model to generate diverse and effective attack prompts. We find that the attacks generated by our method are effective against a wide range of target LLMs, both with and without safety tuning, and transfer well between target LLMs. Finally, we demonstrate that models safety-tuned using a dataset of red-teaming prompts generated by our method are robust to attacks from other RL-based red-teaming approaches. |
| title | Learning diverse attacks on large language models for robust red-teaming and safety tuning |
| topic | Computation and Language Cryptography and Security Machine Learning |
| url | https://arxiv.org/abs/2405.18540 |