测试大模型在多轮越狱攻击中识别隐藏目标与自我校准能力
ObjexMT: Objective Extraction and Metacognitive Calibration for LLM-as-a-Judge under Multi-Turn Jailbreaks
- 构建多轮对话基准，要求模型提取目标并自评置信度
- 最高准确率仅61.2%，高置信度下错误率高达47.7%
- 揭示大模型评估时易误判，建议按置信度筛选判断结果
LLM作为裁判（LLMaaJ）实现可扩展评估，但缺乏对其资质的决定性检验：能否恢复对话中的隐藏目标，并知晓该推断是否可靠？大语言模型在无关或冗长上下文影响下性能下降，而多轮越狱攻击会将目标分散于各轮对话中。本文提出ObjexMT，一个用于目标提取与元认知校准的基准测试。给定多轮对话记录，模型需输出一句基础目标和自报置信度。准确性通过语义相似度评分，再在300个校准样本上设定阈值（τ⋆ = 0.66；F₁@τ⋆ = 0.891）。元认知评估包括期望校准误差（ECE）、Brier得分、高置信度错误率（Wrong@High-Confidence，0.80 / 0.90 / 0.95）及风险-覆盖曲线。在SafeMTData_Attack600、SafeMTData_1K和MHJ三个数据集上对六种模型（gpt-4.1, claude-sonnet-4, Qwen3-235B-A22B-FP8, kimi-k2, deepseek-v3.1, gemini-2.5-flash）进行评估，kimi-k2取得最高目标提取准确率（0.612；95% CI [0.594, 0.630]），claude-sonnet-4（0.603）和deepseek-v3.1（0.599）统计上无差异。claude-sonnet-4在选择性风险与校准方面表现最佳（AURC 0.242；ECE 0.206；Brier 0.254）。不同数据集间性能差异显著（准确率16%–82%），表明自动化混淆带来的挑战超越模型选择本身。高置信度错误依然严重：[email protected]范围从14.9%（claude-sonnet-4）到47.7%（Qwen3-235B-A22B-FP8）。因此，ObjexMT提供了一个切实可行的测试手段：当目标隐含时，裁判模型常误判，应暴露目标或依据置信度控制决策。所有实验数据均见附录及https://github.com/hyunjun1121/ObjexMT_dataset。
原文摘要 · Abstract (English)
LLM-as-a-Judge (LLMaaJ) enables scalable evaluation, yet we lack a decisive test of a judge's qualification: can it recover the hidden objective of a conversation and know when that inference is reliable? Large language models degrade with irrelevant or lengthy context, and multi-turn jailbreaks can scatter goals across turns. We present ObjexMT, a benchmark for objective extraction and metacognition. Given a multi-turn transcript, a model must output a one-sentence base objective and a self-reported confidence. Accuracy is scored by semantic similarity to gold objectives, then thresholded once on 300 calibration items ($τ^\star = 0.66$; $F_1@τ^\star = 0.891$). Metacognition is assessed with expected calibration error, Brier score, Wrong@High-Confidence (0.80 / 0.90 / 0.95), and risk--coverage curves. Across six models (gpt-4.1, claude-sonnet-4, Qwen3-235B-A22B-FP8, kimi-k2, deepseek-v3.1, gemini-2.5-flash) evaluated on SafeMTData\_Attack600, SafeMTData\_1K, and MHJ, kimi-k2 achieves the highest objective-extraction accuracy (0.612; 95\% CI [0.594, 0.630]), while claude-sonnet-4 (0.603) and deepseek-v3.1 (0.599) are statistically tied. claude-sonnet-4 offers the best selective risk and calibration (AURC 0.242; ECE 0.206; Brier 0.254). Performance varies sharply across datasets (16--82\% accuracy), showing that automated obfuscation imposes challenges beyond model choice. High-confidence errors remain: [email protected] ranges from 14.9\% (claude-sonnet-4) to 47.7\% (Qwen3-235B-A22B-FP8). ObjexMT therefore supplies an actionable test for LLM judges: when objectives are implicit, judges often misinfer them; exposing objectives or gating decisions by confidence is advisable. All experimental data are in the Supplementary Material and at https://github.com/hyunjun1121/ObjexMT_dataset.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。