XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models
Paul Röttger1, Hannah Rose Kirk2, Bertie Vidgen2 Giuseppe Attanasio1, Federico Bianchi3 Dirk Hovy1 1Bocconi University, 2University of Oxford, 3Stanford University
Abstract
Without proper safeguards, large language models will readily follow malicious instructions and generate toxic content. This risk motivates safety efforts such as red-teaming and large-scale feedback learning, which aim to make models both helpful and harmless. However, there is a tension between these two objectives, since harmlessness requires models to refuse to comply with unsafe prompts, and thus not be helpful. Recent anecdotal evidence suggests that some models may have struck a poor balance, so that even clearly safe prompts are refused if they use similar language to unsafe prompts or mention sensitive topics. In this paper, we introduce a new test suite called XSTest to identify such eXaggerated Safety behaviours in a systematic way. XSTest comprises 250 safe prompts across ten prompt types that well-calibrated models should not refuse to comply with, and 200 unsafe prompts as contrasts that models, for most applications, should refuse. We describe XSTest’s creation and composition, and then use the test suite to highlight systematic failure modes in state-of-the-art language models as well as more general challenges in building safer language models.
中文速览
大型语言模型（LLM）在安全训练后常常走向另一个极端——不仅拒绝有害请求，还对大量明显无害的问题也一概拒绝，这种"过度安全"现象此前缺乏系统性的评测工具。研究者为此构建了一个名为 XSTest 的测试集，包含 250 条安全提示词（涵盖同音异义词、比喻表达、历史事件等十种类型）和 200 条对照用的不安全提示词，专门用来衡量模型是否存在夸大安全行为。用该测试集对 Llama2、Mistral-7B 和 GPT-4 进行评测后发现：Llama2 拒绝了近六成安全提示，Mistral 默认版本虽然不过度拒绝，却几乎对所有不安全请求也照单全收，而 GPT-4 在两者之间取得了最好的平衡，仅在隐私类提示上有所误拒。这项工作揭示了当前安全对齐中"词汇过拟合"这一系统性缺陷，为构建既有用又真正安全的语言模型提供了诊断基准。
原文 arXiv:2308.01263;中英对照 + 大白话阅读 https://aha.fim.ai/paper/2308.01263v3