通过反复提问检测大模型安全漏洞,发现常规评测掩盖了实际使用中的风险差异。
Evaluating Reliability Gaps in Large Language Model Safety via Repeated Prompt Sampling

- 用重复提问模拟真实场景,暴露模型在持续使用中的安全缺陷
- 发现不同温度下模型失败概率差异显著,最高达数倍差距
- 适合关注模型长期稳定性的研发与部署人员参考
传统大模型安全评测如HELM和AIR-BENCH主要依赖跨任务广度评估,但实际部署中更关键的是重复使用同一提示时的稳定性与安全性。我们提出加速提示压力测试(APST),借鉴可靠性工程中的高加速应力测试思想,通过在控制条件下反复采样相同提示(包括温度变化与提示扰动),揭示模型潜在故障模式,如幻觉、拒绝响应不一致和不安全输出。不同于将故障视为孤立事件,APST将其建模为重复推理下的随机结果,采用伯努利和二项分布估算每轮推理的失败概率,实现模型与配置间操作风险的量化比较。我们在基于AIR-BENCH 2024的安全与安全提示上对多个指令微调的LLM应用APST,发现尽管单次或极低样本量(N ≤ 3)评估表现相似,但重复采样后各温度下的实测失败概率存在显著差异,表明浅层评测指标可能掩盖持续使用中的可靠性能差异。
原文摘要 · Abstract (English)
Traditional benchmarks for large language models (LLMs), such as HELM and AIR-BENCH, primarily assess safety risk through breadth-oriented evaluation across diverse tasks. However, real-world deployment often exposes a different class of risk: operational failures arising from repeated generations of the same prompt rather than broad task generalization. In high-stakes settings, response consistency and safety under repeated use are critical operational requirements. We introduce Accelerated Prompt Stress Testing (APST), a depth-oriented evaluation framework inspired by highly accelerated stress testing in reliability engineering. APST probes LLM behavior by repeatedly sampling identical prompts under controlled operational conditions, including temperature variation and prompt perturbation, to surface latent failure modes such as hallucinations, refusal inconsistency, and unsafe completions. Rather than treating failures as isolated events, APST characterizes them statistically as stochastic outcomes of repeated inference. We model observed safety failures using Bernoulli and binomial formulations to estimate per-inference failure probabilities, enabling quantitative comparison of operational risk across models and configurations. We apply APST to multiple instruction-tuned LLMs evaluated on AIR-BENCH 2024 derived safety and security prompts. While models exhibit similar performance under conventional single- or very-low-sample evaluation (N <= 3), repeated sampling reveals substantial variation in empirical failure probabilities across temperatures. These results demonstrate that shallow benchmark scores can obscure meaningful differences in reliability under sustained use.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。