一句话：提出 DistillSeq，通过知识蒸馏与恶意查询生成，低成本高效测试 LLM 安全对齐。
大语言模型可能生成有害内容，需严格的安全对齐测试，但全面测试计算开销巨大、成本高昂。本文提出 DistillSeq 框架：首先将 LLM 的审核知识蒸馏到小模型，随后采用基于语法树和基于 LLM 的两种策略生成恶意查询，最后通过顺序过滤-测试流程筛出易引发毒性响应的测试用例，从而减少无谓的 LLM 交互。作者在 GPT-3.5、GPT-4.0、Vicuna-13B 与 Llama-13B 上评估：未用 DistillSeq 时攻击成功率分别为 31.5%、21.4%、28.3%、30.9%；使用后提升至 58.5%、50.7%、52.5%、54.4%，平均提升 93.0%，显著降低了有效测试所需的时间与资源。
Large Language Models (LLMs) have showcased their remarkable capabilities in diverse domains, encompassing natural language understanding, translation, and even code generation. The potential for LLMs to generate harmful content is a significant concern. This risk necessitates rigorous testing and comprehensive evaluation of LLMs to ensure safe and responsible use. However, extensive testing of LLMs requires substantial computational resources, making it an expensive endeavor. Therefore, exploring cost-saving strategies during the testing phase is crucial to balance the need for thorough evaluation with the constraints of resource availability. To address this, our approach begins by transferring the moderation knowledge from an LLM to a small model. Subsequently, we deploy two distinct strategies for generating malicious queries: one based on a syntax tree approach, and the other leveraging an LLM-based method. Finally, our approach incorporates a sequential filter-test process designed to identify test cases that are prone to eliciting toxic responses. By doing so, we significantly curtail unnecessary or unproductive interactions with LLMs, thereby streamlining the testing process. Our research evaluated the efficacy of DistillSeq across four LLMs: GPT-3.5, GPT-4.0, Vicuna-13B, and Llama-13B. In the absence of DistillSeq, the observed attack success rates on these LLMs stood at 31.5% for GPT-3.5, 21.4% for GPT-4.0, 28.3% for Vicuna-13B, and 30.9% for Llama-13B. However, upon the application of DistillSeq, these success rates notably increased to 58.5%, 50.7%, 52.5%, and 54.4%, respectively. This translated to an average escalation in attack success rate by a factor of 93.0% when compared to scenarios without the use of DistillSeq. Such findings highlight the significant enhancement DistillSeq offers in terms of reducing the time and resource investment required for effectively testing LLMs.
@inproceedings{paperbot8604,
title = {DistillSeq: A Framework for Safety Alignment Testing in Large Language Models using Knowledge Distillation},
author = {Mingke Yang and Yuqi Chen and Yi Liu and Ling Shi},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680304}
}