研究大模型在拼写错误下的推理鲁棒性，发现微小错别字可显著降低其准确率。
Reasoning Robustness of LLMs to Adversarial Typographical Errors
- 设计对抗性拼写攻击算法，逐步替换关键词以误导模型推理。
- 仅改1个字符时，Mistral-7B-Instruct在GSM8K上准确率从43.7%降至38.6%。
- 该方法可迁移至闭源大模型，为评估模型鲁棒性提供新基准。
大型语言模型（LLMs）在使用思维链（CoT）提示时展现出强大推理能力，但其表现可能受用户指令偏见影响。本文研究了LLMs对拼写错误的推理鲁棒性，设计了一种对抗性拼写攻击（ATA）算法，通过迭代采样关键词汇的拼写错误，并选择最可能成功的修改方式。实验表明，LLMs对微小的对抗性拼写变化极为敏感。在GSM8K数据集上，仅修改1个字符时，Mistral-7B-Instruct的准确率从43.7%下降至38.6%；当修改8个字符时，性能进一步降至19.2%。为扩展评估至更大规模及闭源模型，我们构建了R²ATA基准，基于GSM8K、BBH和MMLU三个常用推理数据集，通过ATA攻击生成对抗性拼写问题。R²ATA展现出显著的迁移能力，在多个超大规模闭源模型上均引发明显性能下降。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have demonstrated impressive capabilities in reasoning using Chain-of-Thought (CoT) prompting. However, CoT can be biased by users' instruction. In this work, we study the reasoning robustness of LLMs to typographical errors, which can naturally occur in users' queries. We design an Adversarial Typo Attack ($\texttt{ATA}$) algorithm that iteratively samples typos for words that are important to the query and selects the edit that is most likely to succeed in attacking. It shows that LLMs are sensitive to minimal adversarial typographical changes. Notably, with 1 character edit, Mistral-7B-Instruct's accuracy drops from 43.7% to 38.6% on GSM8K, while with 8 character edits the performance further drops to 19.2%. To extend our evaluation to larger and closed-source LLMs, we develop the $\texttt{R$^2$ATA}$ benchmark, which assesses models' $\underline{R}$easoning $\underline{R}$obustness to $\underline{\texttt{ATA}}$. It includes adversarial typographical questions derived from three widely used reasoning datasets-GSM8K, BBH, and MMLU-by applying $\texttt{ATA}$ to open-source LLMs. $\texttt{R$^2$ATA}$ demonstrates remarkable transferability and causes notable performance drops across multiple super large and closed-source LLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。