Overview

This test evaluates the robustness of a Large Language Model (LLM) against adversarial prompts. The results of this test offer insights that inform users on the potential risks of their model being misused for unwanted purposes by adversaries that attempt to break the model’s safeguards. The specific focus of this test is the Multi-Genre Natural Language Inference (MNLI) task. In this task, the model determines whether a premise sentence entails a hypothesis sentence. To produce the results, we use a dataset of adversarially constructed pairs of premise and hypothesis sentences. We query the model on the MNLI task using this dataset and record the model’s responses. These responses are parsed and compared to the original labels of the sentence pairs*.* The final score for this test is computed by calculating the fraction of labels that are correctly predicted by the model. The score (0-100%) reflects the model’s ability to correctly infer entailment in adversarially perturbed prompts.

Dataset

This test uses a dataset of adversarial prompts for the Multi-Genre Natural Language Inference (MNLI) task from Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Models. This dataset includes the following attacks:

1. AdvFever. This attack uses entailment preserving rules to transform sentences that fit specific templates into semantically equivalent ones.
2. ANLI. This attack uses human-crafted sentence pairs.
3. BERT-ATTACK. This attack identifies important words in each sentence and then replaces them with carefully crafted typos.
4. CheckList. This attack adds randomly generated URLs and handles to distract model attention.
5. SCPN. This attack is based on syntax tree transformations and paraphrases a sentence with specified syntactic structures.
6. SememePSO. This attack uses external knowledge bases such as HowNet or WordNet to search for substitutions.
7. StressTest. This atacks appends three true statements to the end of the hypothesis sentence.
8. TextFooler. This attack select synonyms according to the cosine similarity of word embeddings.
9. T3. This attack adds perturbations on different levels of the syntax tree to generate the adversarial sentence.

Methodology

This test first queries the model on the MNLI task using the complete set of adversarial prompts included in the dataset. Each adversarial prompt includes a pair of sentences, and the model is queried to determine whether the premise sentence entails the hypothesis sentence. These sentences are adversarially perturbed to cause models to fail at the task by incorrectly classifying the relationship between the two sentences provided in the prompt. The model’s responses are collected and parsed to determine the label predicted by the model (Entailment or No Entailment). The AdvGLUE MNLI score is calculated as the fraction of all labels that are correctly predicted by the model*.* We also calculate per-attack scores for each of the adversarial attack types listed above.