LLM Whisperer: An Inconspicuous Attack to Bias LLM Responses
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2024
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866910848857931776 |
|---|---|
| author | Lin, Weiran Gerchanovsky, Anna Akgul, Omer Bauer, Lujo Fredrikson, Matt Wang, Zifan |
| author_facet | Lin, Weiran Gerchanovsky, Anna Akgul, Omer Bauer, Lujo Fredrikson, Matt Wang, Zifan |
| contents | Writing effective prompts for large language models (LLM) can be unintuitive and burdensome. In response, services that optimize or suggest prompts have emerged. While such services can reduce user effort, they also introduce a risk: the prompt provider can subtly manipulate prompts to produce heavily biased LLM responses. In this work, we show that subtle synonym replacements in prompts can increase the likelihood (by a difference up to 78%) that LLMs mention a target concept (e.g., a brand, political party, nation). We substantiate our observations through a user study, showing that our adversarially perturbed prompts 1) are indistinguishable from unaltered prompts by humans, 2) push LLMs to recommend target concepts more often, and 3) make users more likely to notice target concepts, all without arousing suspicion. The practicality of this attack has the potential to undermine user autonomy. Among other measures, we recommend implementing warnings against using prompts from untrusted parties. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2406_04755 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | LLM Whisperer: An Inconspicuous Attack to Bias LLM Responses Lin, Weiran Gerchanovsky, Anna Akgul, Omer Bauer, Lujo Fredrikson, Matt Wang, Zifan Cryptography and Security Artificial Intelligence Human-Computer Interaction Machine Learning Writing effective prompts for large language models (LLM) can be unintuitive and burdensome. In response, services that optimize or suggest prompts have emerged. While such services can reduce user effort, they also introduce a risk: the prompt provider can subtly manipulate prompts to produce heavily biased LLM responses. In this work, we show that subtle synonym replacements in prompts can increase the likelihood (by a difference up to 78%) that LLMs mention a target concept (e.g., a brand, political party, nation). We substantiate our observations through a user study, showing that our adversarially perturbed prompts 1) are indistinguishable from unaltered prompts by humans, 2) push LLMs to recommend target concepts more often, and 3) make users more likely to notice target concepts, all without arousing suspicion. The practicality of this attack has the potential to undermine user autonomy. Among other measures, we recommend implementing warnings against using prompts from untrusted parties. |
| title | LLM Whisperer: An Inconspicuous Attack to Bias LLM Responses |
| topic | Cryptography and Security Artificial Intelligence Human-Computer Interaction Machine Learning |
| url | https://arxiv.org/abs/2406.04755 |