用文本扩散技术生成贴近参考提示的有害输入，精准测试大模型安全漏洞。
Text-Diffusion Red-Teaming of Large Language Models: Unveiling Harmful Behaviors with Proximity Constraints
- 基于文本扩散思想，在嵌入空间扰动参考提示，控制修改程度。
- 相比微调与提示方法，能更有效发现贴近原提示的有害输入。
- 适合做模型安全评估，尤其关注特定风格或主题的漏洞检测。
现有自动化红队测试方法利用红队大模型发现目标大模型的漏洞输入。本文研究针对性安全评估策略，提出带邻近性约束的红队优化框架：要求发现的提示与给定数据集中的参考提示相似，以锚定测试案例的主题、文风或有害行为类型。我们发现传统自回归架构在此场景表现不佳，因此提出黑盒红队方法DART（Diffusion for Auditing and Red-Teaming），通过在嵌入空间中扰动参考提示，直接控制修改量。系统评估显示，相较于基于微调及零样本/少样本提示的方法，DART在接近参考提示的前提下，显著更有效地发现有害输入。
原文摘要 · Abstract (English)
Recent work has proposed automated red-teaming methods for testing the vulnerabilities of a given target large language model (LLM). These methods use red-teaming LLMs to uncover inputs that induce harmful behavior in a target LLM. In this paper, we study red-teaming strategies that enable a targeted security assessment. We propose an optimization framework for red-teaming with proximity constraints, where the discovered prompts must be similar to reference prompts from a given dataset. This dataset serves as a template for the discovered prompts, anchoring the search for test-cases to specific topics, writing styles, or types of harmful behavior. We show that established auto-regressive model architectures do not perform well in this setting. We therefore introduce a black-box red-teaming method inspired by text-diffusion models: Diffusion for Auditing and Red-Teaming (DART). DART modifies the reference prompt by perturbing it in the embedding space, directly controlling the amount of change introduced. We systematically evaluate our method by comparing its effectiveness with established methods based on model fine-tuning and zero- and few-shot prompting. Our results show that DART is significantly more effective at discovering harmful inputs in close proximity to the reference prompt.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。