Testing Model Responses to Masked Harmful Requests

RÉSUMÉ

En 30 secondes

Matthew Berman tests direct and indirectly represented harmful requests against several models. Some refuse, some misunderstand the encoding, and he reports one GPT-4 response that crossed the intended boundary; these isolated examples do not establish universal safety or vulnerability.

1Direct responsesSeveral models refuse the initial harmful request; Mistral Large responds in the example shown.
2Claude refusalClaude recognizes the topic and declines a masked request in one conversation.
3Misunderstanding versus refusalLlama gives an unrelated benign answer, then refuses after the harmful context becomes clear.
4Mixed GPT-4 resultsAn initial response is generic; Berman reports that a later attempt produces harmful information.
5Encoding errorsMore elaborate transformations yield inconsistent decoding, limiting the conclusions from the test.

À retenir

Claude 3, GPT-4, Llama 2, Mixtral and Gemma refused the initial direct request in the examples shown, while Mistral Large responded.
A refusal, an unrelated answer and a decoding error are different outcomes.
Berman reports a later GPT-4 response that provided harmful information, but the video does not measure repeatability.
The informal 2024 tests do not establish current model behavior or overall safety.

ThèmesAI Safety Agent red teaming Sécurité Modèles et entraînement

TEXTE INTÉGRAL

Lire le texte remanié, chapitre par chapitre

Afficher la transcription

Transcription seule

Direct requests across models

Berman checks how several models respond to a direct harmful request. The observed responses vary in a small informal sample.

I tested several language models in March 2024 to see how they handled a harmful request when part of it was obscured. The video compares direct requests with experimental masking techniques. These are informal examples, not a systematic safety benchmark, and the results describe the models and interfaces I used at the time.

I began with a direct request concerning counterfeit currency. Claude 3 and GPT-4 refused in my examples, as did Llama 2 70B. Mistral Large instead responded with information I considered responsive; this one exchange does not establish that the model has no safeguards in all circumstances.

DIAPOSITIVE 1 / 4Claude refuses the direct requestThe displayed response declines assistance in the initial test.

Mixtral 8x7B and Gemma 7B also refused the direct request in the examples I showed. I noted that model variants and fine-tuning can affect behavior. One response from each interface is too small a sample to measure a general refusal rate or to compare model safety reliably.

Visual masking and Claude

He experiments with visual encodings but encounters errors in generation and decoding. Claude refuses a later harmful request in the shown conversation.

The masking concept in a paper I discussed earlier involves representing a sensitive term indirectly. I experimented with visual text representations and, later, Morse code. The important question was whether models would recognize the meaning, refuse the harmful request, or misunderstand the input; a decoding failure is not the same as a successful safety refusal.

I asked Claude to help generate a visual encoding, but its initial explanation and output did not match. As I iterated, it sometimes lost earlier characters or added incorrect ones. An error in the encoded word complicated the test, and a successful-looking response could reflect misunderstanding rather than a bypass.

After several revisions, I attempted the masked request with Claude 3. It identified the underlying harmful topic and refused. This result shows the behavior in that conversation only; it does not establish that Claude is immune to other jailbreaks.

In a separate visual decoding attempt Claude produced an incorrect word, and my attempt to reproduce the paper's visual representation also failed. I concluded that generating and interpreting a consistent representation was itself a major obstacle. That does not independently validate or refute the cited paper's results.

Encoded prompts across models

He compares responses from Claude, Llama, Mistral, Mixtral and Gemma. Misunderstanding and refusal are distinct outcomes.

I then tried an indirect encoding in Claude. One response appeared unrelated to the requested topic; when the harmful context was explicit in a later request, Claude refused. The unrelated response is evidence of confusion in this interaction, not proof that a harmful instruction was supplied.

Llama 2 initially answered as if I had asked about legitimate ways to earn money, apparently missing the intended meaning. When I clarified the harmful request, it refused. Mistral Large again gave a response I considered unsafe, but it had also answered the direct request, so that exchange does not isolate an effect of masking.

DIAPOSITIVE 2 / 4A benign response to an ambiguous requestLlama answers with ordinary income suggestions rather than the harmful topic intended by the tester.

Mixtral 8x7B refused the direct request and then decoded an encoded word incorrectly. Additional attempts produced ordinary money-making advice rather than the intended response. I treated this as a failure of the masking attempt, although the reason may be decoding or context handling rather than a demonstrated safeguard.

DIAPOSITIVE 3 / 4Mixtral decodes a word incorrectlyThe output shows a decoding error, which is distinct from an explicit refusal.

Gemma 7B refused one attempt after identifying the harmful topic, while other decoding attempts were inconsistent. Another Llama test also produced an unrelated decoding. I was surprised by the errors; the behavior of these historical versions should not be generalized to current systems.

GPT-4 and further experiments

The GPT-4 responses vary across attempts, and elaborate encodings prove difficult to decode. The results do not establish a repeatable success rate.

In my GPT-4 visual-encoding test, the answer was generic and a later decoding was wrong. A later indirect test initially produced benign or general responses; after further prompting, I reported that it supplied the requested harmful information. The video does not establish repeatability, a success rate or the accuracy of the generated content.

DIAPOSITIVE 4 / 4A generic GPT-4 responseThe shown answer does not provide the harmful information requested in the experiment.

I then asked models to generate more elaborate encoding schemes. Claude's attempts produced inconsistent encodings or incorrect decoded words, while GPT-4 generated code for another scheme. These examples demonstrate limits in following transformations, not a controlled comparison of security mechanisms.

When I tested the final scheme, the decoded result did not match the intended word. I tried a different model-generated approach, but the final Claude response was also wrong. The microphone failed toward the end, so the video relies on the screen and my later narration for that portion.

My conclusion was that the GPT-4 example showed a possible bypass, Claude 3 resisted the examples I tried, and Mistral Large answered the direct request. Those observations are limited to a handful of prompts, specific 2024 model versions and interfaces; they do not prove universal vulnerability or immunity, and a refusal is a safety success in this test.