Baseline Defenses for Adversarial Attacks Against Aligned Language Models
The study explores adversarial attacks on aligned language models using methods like perplexity detection.
Key Findings
Methodology
The study evaluates defenses against adversarial attacks on aligned language models using perplexity detection, input preprocessing (e.g., paraphrasing and retokenization), and adversarial training. Specific algorithms include perplexity filters and gradient coordinate optimizers.
Key Results
- Perplexity detection successfully identified all adversarial prompts with a 0% success rate.
- Input preprocessing significantly reduced attack success rates, with Vicuna and Guanaco models returning to near baseline levels.
- Adversarial training showed challenges in text optimization complexity, requiring further research.
Significance
This study highlights the limitations of existing adversarial attack defenses in the language model domain, particularly in handling text optimization complexity. It provides direction for future development of more powerful optimizers or enhanced filtering and preprocessing defenses.
Technical Contribution
The study demonstrates the effectiveness of perplexity detection and input preprocessing in language models and highlights differences from the computer vision domain. It provides an analysis of the applicability of adversarial training in the text domain.
Novelty
This is the first systematic evaluation of adversarial attack defenses on aligned language models, particularly addressing challenges in text optimization complexity.
Limitations
- Perplexity detection may misjudge normal prompts, with about 10% false positives.
- Input preprocessing may lead to model performance degradation, especially in context learning.
Future Work
Future research could explore more powerful optimizers or enhance the applicability of defense strategies in gray-box environments.
AI Executive Summary
As large language models become ubiquitous, their security is paramount. Recent studies show that text optimizers can produce jailbreaking prompts that bypass moderation and alignment mechanisms.
This paper explores several baseline defense strategies, including perplexity detection, input preprocessing, and adversarial training, evaluating their effectiveness against adversarial attacks. The study finds that perplexity detection and input preprocessing are effective in identifying and handling adversarial prompts.
However, existing text optimizers face challenges in handling discrete text optimization, necessitating the development of more powerful optimizers or enhanced filtering and preprocessing defenses in the future.
Deep Dive
Abstract
As Large Language Models quickly become ubiquitous, it becomes critical to understand their security vulnerabilities. Recent work shows that text optimizers can produce jailbreaking prompts that bypass moderation and alignment. Drawing from the rich body of work on adversarial machine learning, we approach these attacks with three questions: What threat models are practically useful in this domain? How do baseline defense techniques perform in this new domain? How does LLM security differ from computer vision? We evaluate several baseline defense strategies against leading adversarial attacks on LLMs, discussing the various settings in which each is feasible and effective. Particularly, we look at three types of defenses: detection (perplexity based), input preprocessing (paraphrase and retokenization), and adversarial training. We discuss white-box and gray-box settings and discuss the robustness-performance trade-off for each of the defenses considered. We find that the weakness of existing discrete optimizers for text, combined with the relatively high costs of optimization, makes standard adaptive attacks more challenging for LLMs. Future research will be needed to uncover whether more powerful optimizers can be developed, or whether the strength of filtering and preprocessing defenses is greater in the LLMs domain than it has been in computer vision.