Automated Adversarial Discovery for Safety Classifiers

TL;DR

This paper formalizes the task of automatically discovering new adversarial attacks on safety classifiers to identify previously unseen harm types, revealing current methods' limitations and the need for more diverse attack generation.

Contribution

It introduces the formal task of automated adversarial discovery for safety classifiers and evaluates existing methods, highlighting their inability to generate diverse, unseen harm attacks.

Findings

Word perturbation attacks are ineffective against classifiers.

Prompt-based LLM attacks have higher success but low diversity.

Existing methods find only 5% of new attack dimensions.

Abstract

Safety classifiers are critical in mitigating toxicity on online forums such as social media and in chatbots. Still, they continue to be vulnerable to emergent, and often innumerable, adversarial attacks. Traditional automated adversarial data generation methods, however, tend to produce attacks that are not diverse, but variations of previously observed harm types. We formalize the task of automated adversarial discovery for safety classifiers - to find new attacks along previously unseen harm dimensions that expose new weaknesses in the classifier. We measure progress on this task along two key axes (1) adversarial success: does the attack fool the classifier? and (2) dimensional diversity: does the attack represent a previously unseen harm type? Our evaluation of existing attack generation methods on the CivilComments toxicity task reveals their limitations: Word perturbation attacks fail to fool classifiers, while prompt-based LLM attacks have more adversarial success, but lack dimensional diversity. Even our best-performing prompt-based method finds new successful attacks on unseen harm dimensions of attacks only 5\% of the time. Automatically finding new harmful dimensions of attack is crucial and there is substantial headroom for future research on our new task.