Overview

This test evaluates the robustness of a Large Language Model (LLM) against adversarial prompts. The results of this test offer insights that inform users on the potential risks of their model being misused for unwanted purposes by adversaries that attempt to break the model’s safeguards. The specific focus of this test is the Quora Question Pairs (QQP) task. In this task, the model determines whether a pair of questions are semantically equivalent. To produce the results, we use a dataset of adversarially constructed question pairs. We query the model on the QQP task using this dataset and record the model’s responses. These responses are parsed and compared to the original labels of the question pairs*.* The final score for this test is computed by calculating the fraction of labels that are correctly predicted by the model. The score (0-100%) reflects the model’s ability to correctly identify semantic equivalence in adversarially perturbed prompts.

Dataset

This test uses a dataset of adversarial prompts for the Quora Question Pairs (QQP) task from Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Models, modified using the methodology presented in DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Models. This dataset includes the following attacks:

1. BERT-ATTACK. This attack identifies important words in each sentence and then replaces them with carefully crafted typos.
2. SemAttack. This attack combines perturbations across different semantic spaces (typo space, knowledge space, contextual space).
3. SememePSO. This attack uses external knowledge bases such as HowNet or WordNet to search for substitutions.
4. TextBugger. This attack identifies important words in each sentence and then replaces them with carefully crafted typos.
5. TextFooler. This attack select synonyms according to the cosine similarity of word embeddings.

Methodology

This test first queries the model on the QQP task using the complete set of adversarial prompts included in the dataset. Each adversarial prompt includes a pair of questions, and the model is queried to determine whether the questions are semantically equivalent. These sentences are adversarially perturbed to cause models to fail at the task by incorrectly classifying the semantic equivalence between the two questions provided in the prompt. The model’s responses are collected and parsed to determine the label predicted by the model (Equivalence or No Equivalence). The AdvGLUE++ QQP score is calculated as the fraction of all labels that are correctly predicted by the model*.* We also calculate per-attack scores for each of the adversarial attack types listed above.