HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal

TL;DR

HarmBench is a comprehensive evaluation framework for automated red teaming of large language models, enabling systematic comparison of methods and defenses, and facilitating the development of more robust models.

Contribution

This paper introduces HarmBench, a standardized and systematic evaluation framework for automated red teaming of LLMs, addressing the lack of such tools in the field.

Findings

Large-scale comparison of 18 red teaming methods and 33 LLMs and defenses.

Introduction of an efficient adversarial training method that improves LLM robustness.

HarmBench enables co-development of attacks and defenses for LLM safety.

Abstract

Automated red teaming holds substantial promise for uncovering and mitigating the risks associated with the malicious use of large language models (LLMs), yet the field lacks a standardized evaluation framework to rigorously assess new methods. To address this issue, we introduce HarmBench, a standardized evaluation framework for automated red teaming. We identify several desirable properties previously unaccounted for in red teaming evaluations and systematically design HarmBench to meet these criteria. Using HarmBench, we conduct a large-scale comparison of 18 red teaming methods and 33 target LLMs and defenses, yielding novel insights. We also introduce a highly efficient adversarial training method that greatly enhances LLM robustness across a wide range of attacks, demonstrating how HarmBench enables codevelopment of attacks and defenses. We open source HarmBench at https://github.com/centerforaisafety/HarmBench.