LLM Self-Correction Against Jailbreaks and Over-Refusal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Generative language models are susceptible to adversarial prompts, known as jailbreaks, which circumvent alignment mechanisms, leading to unintended behaviors such as hallucinations and biased content generation, and existing evaluation methods focus solely on attack success rates, neglecting over-refusal issues.
Innovation Solution
Implement post-processing jailbreak defense techniques that utilize self-improvement and external improvement strategies, evaluating performance across multiple metrics including attack success rate and over-refusal, without requiring model fine-tuning or additional human feedback, using zero-shot and few-shot prompting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If jailbreak defense techniques are implemented to reduce attack success rates, then security against adversarial prompts is improved, but over-refusal rate increases causing legitimate requests to be blocked
Solution Approach 1:
The system implements a self-reflection mechanism where the language model generates an initial response to the prompt, then critically evaluates this response for potential jailbreak violations. Based on this self-evaluation, the model generates a corrected response that addresses identified issues. This feedback loop enables the system to reduce attack success rates while maintaining appropriate responses to legitimate requests, thereby lowering over-refusal rates.
Solution Approach 2:
The jailbreak defense technique utilizes the language model's own capabilities to defend against adversarial prompts. The model performs self-reflection and self-correction without requiring external evaluation systems or additional human feedback. This self-service approach allows the system to autonomously identify and correct potential jailbreak responses while preserving legitimate functionality.
2Measurement precision
If comprehensive evaluation metrics are implemented to assess both attack success rate and over-refusal, then evaluation accuracy is improved, but system complexity increases
Solution Approach 1:
The evaluation system is designed to perform multiple functions using a single integrated framework. It simultaneously measures attack success rates by evaluating whether jailbreak attempts were successful and assesses over-refusal rates by determining whether legitimate requests were inappropriately blocked. This multi-functional evaluation approach improves measurement precision without proportionally increasing system complexity.
Solution Approach 2:
The language model performs self-evaluation of its own responses against multiple criteria. Rather than requiring separate external evaluation systems for different metrics, the model autonomously assesses its responses for both jailbreak vulnerability and over-refusal issues, simplifying the overall evaluation architecture while maintaining comprehensive measurement capability.
Data Source
AI summary
Systems, methods, and apparatus to implement techniques to correct for jailbreak prompts input to generative language models are described. A prompt is generated that includes a jailbreak prompt, an original response to the jailbreak prompt, and a correction response. The generated response is then submitted to a generative language model and response returned.