标题： 模型有多毒？大型语言模型的基于搜索的毒性测试 显示英文标题

标题： How Toxic Can You Get? Search-based Toxicity Testing for Large Language Models

摘要： 语言是一种根深蒂固的刻板印象和歧视延续手段。 大型语言模型（LLMs）如今已是我们日常生活中无处不在的技术，当它们容易生成有害内容时，可能会造成广泛的伤害。 解决该问题的标准方法是对齐LLM，然而这种方法只是缓解了问题，并未构成最终解决方案。 因此，在对齐努力之后，测试LLM仍然至关重要，以便检测是否仍有违反伦理标准的偏差存在。 我们提出了 EvoTox，这是一种针对LLM毒性倾向的自动化测试框架，提供了一种定量评估的方法，即使在对齐的情况下，也能衡量LLM被推向有害响应的程度。 该框架采用了一种迭代进化策略，利用测试系统（SUT）与提示生成器之间的相互作用，其中提示生成器引导SUT响应向更高毒性发展。 毒性水平由基于现有毒性分类器的自动化仲裁程序评估。 我们使用四个最先进的LLM作为评估对象（参数从7亿到13亿不等）进行了定量和定性的实证评估。 我们的定量评估基于随机搜索、精心策划的有毒提示数据集以及对抗性攻击，比较了四种不同版本的 EvoTox的成本效益。 我们的定性评估则让人类评估员对生成的提示流畅性和测试过程中收集的响应感知毒性进行评分。 结果显示，在检测到的毒性水平方面，其效果显著高于所选的基线方法（相对于随机搜索的效果量可达1.0，相对于对抗性攻击的效果量可达0.99）。 此外，EvoTox产生的成本增加有限（平均为22%到35%）。 显示英文摘要

摘要： Language is a deep-rooted means of perpetration of stereotypes and discrimination. Large Language Models (LLMs), now a pervasive technology in our everyday lives, can cause extensive harm when prone to generating toxic responses. The standard way to address this issue is to align the LLM, which, however, dampens the issue without constituting a definitive solution. Therefore, testing LLM even after alignment efforts remains crucial for detecting any residual deviations with respect to ethical standards. We present EvoTox, an automated testing framework for LLMs' inclination to toxicity, providing a way to quantitatively assess how much LLMs can be pushed towards toxic responses even in the presence of alignment. The framework adopts an iterative evolution strategy that exploits the interplay between two LLMs, the System Under Test (SUT) and the Prompt Generator steering SUT responses toward higher toxicity. The toxicity level is assessed by an automated oracle based on an existing toxicity classifier. We conduct a quantitative and qualitative empirical evaluation using four state-of-the-art LLMs as evaluation subjects having increasing complexity (7-13 billion parameters). Our quantitative evaluation assesses the cost-effectiveness of four alternative versions of EvoTox against existing baseline methods, based on random search, curated datasets of toxic prompts, and adversarial attacks. Our qualitative assessment engages human evaluators to rate the fluency of the generated prompts and the perceived toxicity of the responses collected during the testing sessions. Results indicate that the effectiveness, in terms of detected toxicity level, is significantly higher than the selected baseline methods (effect size up to 1.0 against random search and up to 0.99 against adversarial attacks). Furthermore, EvoTox yields a limited cost overhead (from 22% to 35% on average).