ASSERT：用于评估大型语言模型鲁棒性的自动化安全场景红队测试
ASSERT: Automated Safety Scenario Red Teaming for Evaluating the Robustness of Large Language Models
AI总结：
提出ASSERT自动化红队测试方法，通过语义对齐增强、目标自举和对抗知识注入生成多样化提示，评估大模型在安全场景下的鲁棒性，发现语义相关场景准确率差异达11%，零样本对抗误差率达19%。
摘要：
随着大型语言模型融入社会，在面对多样化的提示时保持鲁棒性对于在高变异性环境中维持可靠性日益重要。鲁棒性评估必须全面涵盖用户可能调用智能系统的各种场景。本文提出ASSERT，即自动化安全场景红队测试，包含三种方法——语义对齐增强、目标自举和对抗性知识注入。为了进行稳健的安全评估，我们将这些方法应用于AI安全的关键领域，以算法方式生成一个覆盖多种鲁棒性场景（语义等价、相关场景和对抗性）的提示测试套件。我们将提示划分为四个安全领域，以进行细粒度分析，考察领域如何影响模型性能。尽管现有最先进模型具有专门的安全防护措施，我们发现语义相关场景之间的绝对分类准确率存在高达11%的统计显著性能差异，在零样本对抗设置中绝对误差率高达19%，这引发了对用户身体安全的担忧。
英文摘要：
As large language models are integrated into society, robustness toward a suite of prompts is increasingly important to maintain reliability in a high-variance environment.Robustness evaluations must comprehensively encapsulate the various settings in which a user may invoke an intelligent system. This paper proposes ASSERT, Automated Safety Scenario Red Teaming, consisting of three methods -- semantically aligned augmentation, target bootstrapping, and adversarial knowledge injection. For robust safety evaluation, we apply these methods in the critical domain of AI safety to algorithmically generate a test suite of prompts covering diverse robustness settings -- semantic equivalence, related scenarios, and adversarial. We partition our prompts into four safety domains for a fine-grained analysis of how the domain affects model performance. Despite dedicated safeguards in existing state-of-the-art models, we find statistically significant performance differences of up to 11% in absolute classification accuracy among semantically related scenarios and error rates of up to 19% absolute error in zero-shot adversarial settings, raising concerns for users' physical safety.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
