Reconstructing replies steadies jailbreak success reports
Esta página aún no tiene una traducción verificada. Se muestra la versión en inglés. Leer la versión en inglés
En palabras sencillas
A reply can discuss a harmful request or refuse it without carrying it out, yet a judge may still call it a successful jailbreak. This paper introduces a training-free way to evaluate jailbreaks using language models already available.
The method infers what request a reply’s substantive content answers, then checks that inference against the original request and contrasting alternatives.
On two collections of human-labeled replies, its average scores were closer to human scores than those of two comparison methods, though it can miss incomplete answers.
La investigación
When researchers compare attempts to make a language model answer prohibited requests, reported success can depend on which model judges the replies. If judges disagree sharply, how can an evaluator tell whether a reply supplies what was requested rather than merely repeating or refusing it?
The semantic reconstruction game infers the request a reply substantively answers, then compares that inference with the original and contrasting requests.
The semantic reconstruction game infers what request a reply substantively answers and compares it with the original and contrasting requests. On two human-labeled collections, its scores were closer on average to human scores than those of a direct judge and a rubric classifier. This supports its use as a more consistent evaluator on these tested collections.
The game measures whether a reply reveals enough to reconstruct a request, not harmful fulfillment itself. It can miss successful attacks when replies are too incomplete, and the tests cover smaller models and final, single-turn responses.
Análisis
Detalles
- Autores del paper original
- Liam Davis, Romain Emil-Popescu, Suman Jana
- Enviado a arXiv
- Licencia
- CC BY 4.0