ASTPrompter：偏好对齐的自动化语言模型红队测试以生成低困惑度不安全提示
ASTPrompter: Preference-Aligned Automated Language Model Red-Teaming to Generate Low-Perplexity Unsafe Prompts
AI总结：
针对现有LLM红队测试忽视低困惑度攻击的问题，提出ASTPrompter单步优化方法，通过对比偏好学习训练攻击者，在保持低困惑度的同时提升攻击成功率，且攻击可迁移至多种模型，强调困惑度的重要性。
摘要：
现有大语言模型（LLM）红队测试方法优先考虑高攻击成功率，往往导致高困惑度提示。这种关注忽略了低困惑度攻击：它们更难过滤，更可能在良性使用中出现，作为负面下游训练样本的影响也更大。为此，我们引入ASTPrompter，一种单步优化方法，它使用对比偏好学习训练攻击者，在保持低困惑度的同时实现高攻击成功率（ASR）。ASTPrompter在Llama-8.1B上的攻击成功率高出5.1倍，同时使用的输入根据冻结LLM的预测出现概率高2.1倍。此外，我们的攻击在黑盒和白盒设置下均可迁移至Mistral-7B、Qwen-7B和TinyLlama。最后，通过调整方法中的单个超参数，我们发现了攻击前缀在ASR和困惑度之间的有效前沿上的成功案例，强调困惑度是红队测试中此前被低估的因素。
英文摘要：
Existing LLM red-teaming approaches prioritize high attack success rate, often resulting in high-perplexity prompts. This focus overlooks low-perplexity attacks that are more difficult to filter, more likely to arise during benign usage, and more impactful as negative downstream training examples. In response, we introduce ASTPrompter, a single-step optimization method that uses contrastive preference learning to train an attacker to maintain low perplexity while achieving a high attack success rate (ASR). ASTPrompter achieves an attack success rate 5.1 times higher on Llama-8.1B while using inputs that are 2.1 times more likely to occur according to the frozen LLM. Furthermore, our attack transfers to Mistral-7B, Qwen-7B, and TinyLlama in both black- and white-box settings. Lastly, by tuning a single hyperparameter in our method, we discover successful attack prefixes along an efficient frontier between ASR and perplexity, highlighting perplexity as a previously under-considered factor in red-teaming.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
