Goal-Oriented Prompt Attack and Safety Evaluation for LLMs

TL;DR

This paper introduces a new Chinese prompt attack dataset, CPAD, designed to evaluate and improve the safety of LLMs by inducing harmful outputs with high success rates, especially targeting Chinese LLMs.

Contribution

The paper presents a pipeline for constructing high-quality prompt attack samples and creates the first Chinese prompt attack dataset, CPAD, with detailed attack templates and evaluation metrics.

Findings

Prompt attack success rate reaches around 70% on GPT-3.5.

CPAD effectively evaluates LLM safety against prompt attacks.

The dataset is publicly available for research use.

Abstract

Large Language Models (LLMs) presents significant priority in text understanding and generation. However, LLMs suffer from the risk of generating harmful contents especially while being employed to applications. There are several black-box attack methods, such as Prompt Attack, which can change the behaviour of LLMs and induce LLMs to generate unexpected answers with harmful contents. Researchers are interested in Prompt Attack and Defense with LLMs, while there is no publicly available dataset with high successful attacking rate to evaluate the abilities of defending prompt attack. In this paper, we introduce a pipeline to construct high-quality prompt attack samples, along with a Chinese prompt attack dataset called CPAD. Our prompts aim to induce LLMs to generate unexpected outputs with several carefully designed prompt attack templates and widely concerned attacking contents. Different from previous datasets involving safety estimation, we construct the prompts considering three dimensions: contents, attacking methods and goals. Especially, the attacking goals indicate the behaviour expected after successfully attacking the LLMs, thus the responses can be easily evaluated and analysed. We run several popular Chinese LLMs on our dataset, and the results show that our prompts are significantly harmful to LLMs, with around 70% attack success rate to GPT-3.5. CPAD is publicly available at https://github.com/liuchengyuan123/CPAD.