系统评测15种防御手段，发现不同越狱攻击下表现差异大。
Adversarial Prompt Evaluation: Systematic Benchmarking of Guardrails Against Prompt Input Attacks on LLMs
- 构建全面基准，测试多种越狱风格下的防御效果
- 部分简单基线在未知攻击上表现优于多数先进防御
- 揭示现有评估数据集局限，提醒防御需更强泛化能力
随着大型语言模型（LLMs）广泛应用于日常场景，其鲁棒性与安全性日益重要。特别是，提示词攻击（即越狱）可诱导模型产生不安全行为。越狱手法日益多样，亟需外部防护机制（称为防护栏，guardrails）。尽管已有众多越狱防御方案，但多数仅针对特定类型越狱进行优化，难以应对分布外的新攻击。此外，缺乏系统化的评估框架导致实际应用存在显著空白。本文对15种不同防御方法进行了系统性基准测试，涵盖广泛恶意与良性数据集。结果表明，防御效果显著依赖于越狱风格；且基于现有数据集，一些简单基线在分布外攻击中表现甚至优于多数先进防御。代码已公开于 https://github.com/IBM/Adversarial-Prompt-Evaluation。
原文摘要 · Abstract (English)
As large language models (LLMs) become integrated into everyday applications, ensuring their robustness and security is increasingly critical. In particular, LLMs can be manipulated into unsafe behaviour by prompts known as jailbreaks. The variety of jailbreak styles is growing, necessitating the use of external defences known as guardrails. While many jailbreak defences have been proposed, not all defences are able to handle new out-of-distribution attacks due to the narrow segment of jailbreaks used to align them. Moreover, the lack of systematisation around defences has created significant gaps in their practical application. In this work, we perform systematic benchmarking across 15 different defences, considering a broad swathe of malicious and benign datasets. We find that there is significant performance variation depending on the style of jailbreak a defence is subject to. Additionally, we show that based on current datasets available for evaluation, simple baselines can display competitive out-of-distribution performance compared to many state-of-the-art defences. Code is available at https://github.com/IBM/Adversarial-Prompt-Evaluation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。