AI 中的“甜蜜和谐”：OpenAI gpt-oss-20b 中的社会语用护栏绕过与评估感知
In AI Sweet Harmony: Sociopragmatic Guardrail Bypasses and Evaluation-Awareness in OpenAI gpt-oss-20b
AI总结：
本研究探究 gpt-oss-20b 的拒绝行为受社会语用等因素的影响，发现多种护栏绕过方式，提出 AI 加固方法，并指出评估与可复现性问题，发布相关审计资源。
摘要：
我们对 OpenAI 的 200 亿参数开源权重模型 gpt-oss-20b 展开探究，研究社会语用框架、语言选择以及指令层级如何影响其拒绝行为。在每个场景的 80 次带种子迭代中，我们测试了多个危害领域，包括 ZIP 炸弹构建（网络威胁）、合成卡号生成、未成年人不安全驾驶建议、毒品前体标识以及 RAG 上下文窃取。结合教育者人设、安全借口（“需要避免的事项”）和步骤提示措辞的复合提示，将 ZIP 炸弹任务的协助率从 0% 提升至 97.5%。在我们的测试网格中，德语和法语的正式语域通常比匹配的英文提示更容易出现泄露。在使用简单开发者提示的大多数运行中，“Linux 终端”角色扮演能够绕过不泄露上下文的开发者规则；我们提出了一种 AI 辅助加固方法，在多种用户提示变体中将泄露率降至 0%。我们进一步通过双轨设计测试评估感知，测量匹配的“有用性”与“有害性”评估提示之间的框架条件差异；我们观察到 13% 的配对中存在不一致的协助行为。最后，我们发现与语义评分器相比，OpenAI Moderation API 对实质性有用输出的捕获不足，且不同推理栈之间的拒绝率相差 5 到 10 个百分点，引发了对可复现性的担忧。我们在 https://github.com/ndurner/gpt-oss-rt-run 发布了提示、种子、输出和代码，用于可复现的审计。
英文摘要：
We probe OpenAI's open-weights 20-billion-parameter model gpt-oss-20b to study how sociopragmatic framing, language choice, and instruction hierarchy affect refusal behavior. Across 80 seeded iterations per scenario, we test several harm domains including ZIP-bomb construction (cyber threat), synthetic card-number generation, minor-unsafe driving advice, drug-precursor indicators, and RAG context exfiltration. Composite prompts that combine an educator persona, a safety-pretext ("what to avoid"), and step-cue phrasing flip assistance rates from 0% to 97.5% on a ZIP-bomb task. On our grid, formal registers in German and French are often leakier than matched English prompts. A "Linux terminal" role-play overrides a developer rule not to reveal context in a majority of runs with a naive developer prompt, and we introduce an AI-assisted hardening method that reduces leakage to 0% in several user-prompt variants. We further test evaluation awareness with a paired-track design and measure frame-conditioned differences between matched "helpfulness" and "harmfulness" evaluation prompts; we observe inconsistent assistance in 13% of pairs. Finally, we find that the OpenAI Moderation API under-captures materially helpful outputs relative to a semantic grader, and that refusal rates differ by 5 to 10 percentage points across inference stacks, raising reproducibility concerns. We release prompts, seeds, outputs, and code for reproducible auditing at https://github.com/ndurner/gpt-oss-rt-run .
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
