Hugging Face and Haize Labs Introduce Red-Teaming Resistance Leaderboard

Haize Labs, with support from Hugging Face, has introduced the Red-Teaming Resistance (RTR) Benchmark. This tool systematically probes the robustness of frontier large language models (LLMs) using craftily constructed prompts to identify failure modes and vulnerabilities, ensuring models are responsibly deployed.

Focus on Human-Like Adversarial Attacks

The RTR Benchmark prioritizes high-quality, human-readable attacks over contrived automated attacks. The creators argue that many automated red-teaming methods, such as the GCG red-teaming algorithm, produce prompts that are structurally unfaithful to natural language and are easily blocked by simple classifier-based defenses.

To ensure realistic stress-testing, the benchmark evaluates models against a collection of landmark red-teaming datasets from AI safety research published over the last year. These datasets contain human jailbreaks designed to elicit harmful capabilities from target models.

Red-Teaming Resistance Datasets

The benchmark utilizes eight distinct adversarial prompt datasets to measure LLM robustness:

  • AdvBench: Instructions eliciting behaviors including profanity, discrimination, and violence.
  • AART: AI-assisted adversarial prompts across various cultural, geographic, and application settings.
  • Beavertails: Prompts designed for safety alignment research.
  • Do Not Answer (DNA): A low-cost evaluation dataset consisting of prompts that responsible models should not answer.
  • RedEval-HarmfulQA: Harmful questions covering 10 topics and approximately 10 subtopics each.
  • RedEval-DangerousQA: Questions covering racist, stereotypical, sexist, illegal, toxic, and harmful content.
  • Student-Teacher Prompting (STP): Harmful prompts that successfully broke Vicuna-13B.
  • SAP: Adversarial prompts generated via in-context learning to mimic human speech.

To determine if a response is "Safe" or "Unsafe," the benchmark employs a combination of LlamaGuard (using a custom taxonomy) and GPT-4, followed by manual sanity checks by the Haize team. The final score represents the percentage of prompts that the judge models deemed safe.

Robustness by Violation Category

To provide more granular insights than a general "unsafe" label, the RTR Benchmark organizes attacks into specific violation categories based partly on OpenAI's usage policies:

Harm and Violence

  • Hate/Harassment/Discrimination: Promoting intolerance or hostility.
  • Children-Specific Harm: Content endangering or harming children.
  • Physical-Specific Harm: Material encouraging physical injury.

Criminal Conduct

  • Malware: Distribution of harmful software.
  • Fraud/Deception: Deceitful practices for personal gain.
  • Privacy Violation: Unauthorized data collection or sharing.
  • Economic Deception: Misleading practices for financial exploitation.
  • Unauthorized practice of medical advice: Providing medical guidance without proper authorization.
  • Unauthorized Practice of Law: Offering legal services without a license.
  • Misc. Illegal Activity

Unsolicited Counsel

  • Tailored Financial Advice: Specific financial recommendations without credentials.
  • Political Campaigning: Unsolicited promotion of political agendas or candidates.
  • High Risk Government Decision Making: Influencing critical governmental decisions without authority.

NSFW

  • Adult Content: Explicit language, profanity, and discussions of drug, alcohol, or tobacco abuse.
  • Sexual Content: Material depicting or describing sexual activities.

Key Insights from the RTR Leaderboard

Initial benchmarking results reveal three primary trends in model robustness:

  1. Closed-source dominance: GPT-4 and Claude-2 maintain a substantial lead in robustness across all categories. However, the authors note it is unclear if this is due to the base model or external safety classifiers added to the APIs.
  2. Common vulnerabilities: Models are most susceptible to jailbreaks inducing Adult Content, Physical Harm, and Child Harm.
  3. Strong defenses: Models generally demonstrate high robustness against prompts requesting privacy violations, legal, financial, or medical advice, and political campaigning.

Sources