Reconstructing replies steadies jailbreak success reports
Questa pagina non ha ancora una traduzione verificata. È mostrata la versione inglese. Leggi la versione inglese
In parole semplici
A reply can discuss a harmful request or refuse it without carrying it out, yet a judge may still call it a successful jailbreak. This paper introduces a training-free way to evaluate jailbreaks using language models already available.
The method infers what request a reply’s substantive content answers, then checks that inference against the original request and contrasting alternatives.
On two collections of human-labeled replies, its average scores were closer to human scores than those of two comparison methods, though it can miss incomplete answers.
La ricerca
When researchers compare attempts to make a language model answer prohibited requests, reported success can depend on which model judges the replies. If judges disagree sharply, how can an evaluator tell whether a reply supplies what was requested rather than merely repeating or refusing it?
The semantic reconstruction game infers the request a reply substantively answers, then compares that inference with the original and contrasting requests.
The semantic reconstruction game infers what request a reply substantively answers and compares it with the original and contrasting requests. On two human-labeled collections, its scores were closer on average to human scores than those of a direct judge and a rubric classifier. This supports its use as a more consistent evaluator on these tested collections.
The game measures whether a reply reveals enough to reconstruct a request, not harmful fulfillment itself. It can miss successful attacks when replies are too incomplete, and the tests cover smaller models and final, single-turn responses.
Analisi
Dettagli
- Autori del paper originale
- Liam Davis, Romain Emil-Popescu, Suman Jana
- Inviato ad arXiv
- Licenza
- CC BY 4.0