用进化式提示攻击检测大模型遗忘效果，发现现有方法漏洞
REBEL: Hidden Knowledge Recovery via Evolutionary-Based Evaluation Loop
- 设计进化算法生成对抗性提示，主动探测被遗忘数据
- 在TOFU和WMDP数据集上，攻击成功率最高达93%
- 适合评估模型安全性和改进遗忘算法的研究者
大语言模型的机器遗忘旨在移除敏感或受版权保护的数据。然而，当前遗忘方法的实际效果尚不明确。标准评估指标依赖良性查询，常将表面信息抑制误认为真正的知识删除，无法检测出更复杂提示策略仍可提取的残留知识。我们提出REBEL，一种基于进化的对抗性提示生成框架，用于探测被遗忘数据是否仍可恢复。实验表明，REBEL能成功从看似已遗忘的模型中提取出‘被遗忘’的知识，在TOFU和WMDP基准子集上，攻击成功率（ASR）分别达到60%和93%。我们在多个遗忘算法上验证了该框架，结果表明其持续优于静态基线。代码将在论文接受后公开。
原文摘要 · Abstract (English)
Machine unlearning for LLMs aims to remove sensitive or copyrighted data from trained models. However, the true efficacy of current unlearning methods remains uncertain. Standard evaluation metrics rely on benign queries that often mistake superficial information suppression for genuine knowledge removal. Such metrics fail to detect residual knowledge that more sophisticated prompting strategies could still extract. We introduce REBEL, an evolutionary approach for adversarial prompt generation designed to probe whether unlearned data can still be recovered. Our experiments demonstrate that REBEL successfully elicits ``forgotten'' knowledge from models that seemed to be forgotten in standard unlearning benchmarks, revealing that current unlearning methods may provide only a superficial layer of protection. We validate our framework on subsets of the TOFU and WMDP benchmarks, evaluating performance across a diverse suite of unlearning algorithms. Our experiments show that REBEL consistently outperforms static baselines, recovering ``forgotten'' knowledge with Attack Success Rates (ASRs) reaching up to 60% on TOFU and 93% on WMDP. We will make all code publicly available upon acceptance. Code is available at https://github.com/patryk-rybak/REBEL/
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。