This machine learning article introduces JailbreakBench: an open robustness benchmark for jailbreaking large-scale language models.

Evaluating jailbreak attacks against LLM presents challenges, such as lack of standard evaluation practices, incomparable cost and success rate calculations, and numerous tasks that cannot be reproduced because they withhold adversarial prompts, contain closed source code, or rely on evolving proprietary APIs. . Despite LLMs aiming to align with human values, these attacks can still lead to harmful or unethical content, suggesting that even advanced LLMs are not fully adversarially aligned.

Previous research has shown that even the best-performing LLMs are vulnerable to jailbreak attacks due to a lack of adversarial alignment. These attacks can be launched through a variety of means, such as hand-written prompts, assisted LLM, or iterative optimization. Although defense strategies have been proposed, LLM is still very vulnerable. As a result, benchmarking advances in jailbreak attacks and defenses is critical, especially for safety-critical applications.

Introduced by researchers from the University of Pennsylvania, ETH Zurich, EPFL, and Sony AI. jailbreak benchis a benchmark designed to standardize best practices in the evolving field of LLM jailbreak. The core principles focus on full reproducibility through open-source jailbreak prompts, scalability to accommodate new attacks, defenses, and LLMs, and accessibility of the evaluation pipeline for future research. It includes a leaderboard that tracks state-of-the-art jailbreak attacks and defenses, with the goal of facilitating comparisons between algorithms and models. Initial results highlight Llama Guard as the preferred jailbreak evaluator, indicating that both open-source and closed-source LLMs are vulnerable to attacks, despite some mitigation by existing defenses.

JailbreakBench collects and archives jailbreak artifacts with the goal of building a reliable basis for comparison, ensuring maximum reproducibility. The leaderboard tracks cutting-edge jailbreak attacks and defenses, with the goal of identifying the best algorithms and establishing an open source baseline. It allows for different types of jailbreak attacks and defenses, all of which are evaluated using the same metrics. The Red Team pipeline is efficient, inexpensive, and cloud-based, so there is no requirement for a local GPU.

Comparing the three jailbreak attack artifacts within JailbreakBench shows that Llama-2 is more robust than the Vicuna and GPT models. This is probably due to explicit fine-tuning of the jailbreak prompt. JBC’s AIM template targets Vicuna effectively, but fails on Llama-2 and GPT models due to OpenAI’s patch. GCG has a lower jailbreak rate due to its more challenging behavior and conservative jailbreak classification criteria. Defending the model using SmoothLLM and perplexity filters significantly reduces ASR for GCG prompts, while PAIR and JBC remain competitive due to semantically interpretable prompts.

In conclusion, this study introduces an innovative method, JailbreakBench, an open source benchmark for evaluating jailbreak attacks. This benchmark consists of (1) the JBB-Behaviors dataset featuring 100 unique behaviors, (2) an evolving repository of adversarial messages called jailbreak artifacts, (3) a defined threat model, system prompts, and chat templates. and a standardized evaluation framework with scoring capabilities, (4) a leaderboard to monitor offensive and defensive performance across the LLM.

Please confirm Paper, Project, Github. All credit for this study goes to the researchers of this project. Also, don’t forget to follow us Twitter. Our telegram channel, discord channeland LinkedIn GrWhoop.

If you like our work, you will love us Newsletter..

Don’t forget to join us 40,000+ ML subreddits