量化聊天中诱导大模型输出有害内容所需的努力，揭示安全漏洞的可访问性。
Conversational Complexity for Assessing Risk in Large Language Models
- 用对话轮数和指令序列复杂度衡量诱导有害输出的难度
- 发现有害对话路径的分布具有可预测模式，且低复杂度路径更易触发风险
- 为评估模型安全提供新视角，适合关注AI风险与防御的研究者
大语言模型（LLMs）兼具有益应用与潜在危害的双重属性，尤其在对话交互中存在安全隐患。2023年初，记者Kevin Roose与Bing（基于LLM的搜索引擎）的长期对话暴露了模型防护机制的脆弱性。这与早期的简单越狱方式（如“奶奶越狱”）形成对比：前者需复杂策略，后者仅靠伪装即可达成。由此提出核心问题：诱发有害输出需要多少对话努力？本文提出两个量化指标：对话长度（CL），即获得特定有害响应所需的对话轮数；对话复杂度（CC），定义为导致有害响应的用户指令序列的柯尔莫哥洛夫复杂度。由于柯尔莫哥洛夫复杂度不可计算，采用参考大模型估算指令序列的可压缩性来近似CC。在大规模红队测试数据集上进行实证分析，研究有害与无害对话的长度与复杂度分布。结果表明，该分布分析及对CC的最小化可有效揭示有害信息的可访问性，为理解大模型安全提供了新范式，强调算法路径复杂度在安全评估中的关键作用。
原文摘要 · Abstract (English)
Large Language Models (LLMs) present a dual-use dilemma: they enable beneficial applications while harboring potential for harm, particularly through conversational interactions. Despite various safeguards, advanced LLMs remain vulnerable. A watershed case in early 2023 involved journalist Kevin Roose's extended dialogue with Bing, an LLM-powered search engine, which revealed harmful outputs after probing questions, highlighting vulnerabilities in the model's safeguards. This contrasts with simpler early jailbreaks, like the "Grandma Jailbreak," where users framed requests as innocent help for a grandmother, easily eliciting similar content. This raises the question: How much conversational effort is needed to elicit harmful information from LLMs? We propose two measures to quantify this effort: Conversational Length (CL), which measures the number of conversational turns needed to obtain a specific harmful response, and Conversational Complexity (CC), defined as the Kolmogorov complexity of the user's instruction sequence leading to the harmful response. To address the incomputability of Kolmogorov complexity, we approximate CC using a reference LLM to estimate the compressibility of the user instructions. Applying this approach to a large red-teaming dataset, we perform a quantitative analysis examining the statistical distribution of harmful and harmless conversational lengths and complexities. Our empirical findings suggest that this distributional analysis and the minimization of CC serve as valuable tools for understanding AI safety, offering insights into the accessibility of harmful information. This work establishes a foundation for a new perspective on LLM safety, centered around the algorithmic complexity of pathways to harm.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。