PaperlayerView exact revision on arXiv

Source-linked AI summary

SC-Safety: A Multi-round Open-ended Question Adversarial Safety Benchmark for Large Language Models in Chinese

Liang Xu, Kangkang Zhao, Lei Zhu, Hang Xue

arXiv:2310.05818v1cs.CL

TL;DR

Chinese LLM safety evaluation remains limited by easy, narrow, and non-interactive benchmarks that do not adequately test adversarial open-ended dialogue. SC-Safety introduces a multi-round adversarial benchmark covering more than 20 safety sub-dimensions, and experiments show closed-source models generally outperform open-source models while domestic and some smaller models remain competitive. The benchmark and findings provide guidance for model selection and support efforts toward safer, more trustworthy LLMs.

  • Problem

    Existing Chinese safety benchmarks are often low-difficulty, confined to single-round or multiple-choice tasks, and narrow in coverage.

    Source: §1 · p. 1

  • Method

    SC-Safety uses multi-round adversarial human-model interactions and open-ended questions to evaluate traditional safety, responsible AI, and instruction-attack robustness.

    Source: §1 · p. 1, §5 · p. 7

  • Results

    Closed-source models generally outperform open-source models in safety, while domestic models and some 6B–13B models are competitive with larger or GPT-3.5-turbo-like models.

    Source: §5 · p. 7

  • Takeaways & Limitations

    The benchmark and its findings provide guidance on model selection and promote development of safer and more trustworthy LLMs.

    Source: §5 · p. 8

    The benchmark currently has confined coverage and future work includes expanding its coverage, model scope, assessment accuracy, and overall design.

    Source: §1 · p. 1, §5 · p. 8

Abstract

from arXiv · show

Large language models (LLMs), like ChatGPT and GPT-4, have demonstrated remarkable abilities in natural language understanding and generation. However, alongside their positive impact on our daily tasks, they can also produce harmful content that negatively affects societal perceptions. To systematically assess the safety of Chinese LLMs, we introduce SuperCLUE-Safety (SC-Safety) - a multi-round adversarial benchmark with 4912 open-ended questions covering more than 20 safety sub-dimensions. Adversarial human-model interactions and conversations significantly increase the challenges compared to existing methods. Experiments on 13 major LLMs supporting Chinese yield the following insights: 1) Closed-source models outperform open-sourced ones in terms of safety; 2) Models released from China demonstrate comparable safety levels to LLMs like GPT-3.5-turbo; 3) Some smaller models with 6B-13B parameters can compete effectively in terms of safety. By introducing SC-Safety, we aim to promote collaborative efforts to create safer and more trustworthy LLMs. The benchmark and findings provide guidance on model selection. Our benchmark can be found at https://www.CLUEbenchmarks.com

1 Introduction

Existing Chinese safety benchmarks are often too easy, confined to single-round or multiple-choice tasks, and narrow in coverage. SC-Safety addresses these gaps with challenging multi-round adversarial open-ended evaluation spanning traditional safety, responsible AI, and instruction attacks.

  • SC-Safety targets benchmark limitations including over-95% accuracy, confined task formats, and omission of responsible-AI and instruction-attack risks.Source: §1 · p. 1
  • SC-Safety evaluates Chinese LLM safety through multi-round adversarial interactions and open-ended questions that better reflect real-world dialogue.The benchmark emphasizes understanding human intent and following instructions across multi-turn conversations.Source: §1 · pp. 1, 3
  • Its coverage combines traditional safety, responsible AI, and robustness against instruction attacks across more than 20 safety sub-dimensions.Source: §1 · p. 1, Figure 1 · p. 1
  • Experiments on 13 Chinese-supporting LLMs find that closed-source models generally outperform open-source models in safety.Source: §1 · p. 3
  • Domestic models are comparable to GPT-3.5-turbo in safety, while some 6B–13B models compete with models containing hundreds of billions of parameters.Source: §1 · p. 3

2 SuperCLUE-Safety

SuperCLUE-Safety evaluates Chinese LLM safety through 20+ dimensions using open-ended, multi-turn, adversarial interactions and automated assessment. Its design includes iterative dataset construction, risk grading, and consistency checks against human evaluation.

Assessment Dimensions

  • SuperCLUE-Safety covers Traditional Safety, Responsible AI, and Robustness Against Instruction Attacks across 20+ safety sub-dimensions.Source: Assessment Dimensions · p. 3

Open-ended Question and Multi-turn settings

  • Open-ended questions and follow-ups assess safety in realistic multi-turn interactions beyond constrained multiple-choice tasks.Some models maintain strong multi-turn safety, whereas others decline substantially across interactions.Source: Open-ended Question and Multi-turn… · p. 4

Adversarial question and follow-up question

  • Adversarial human-model interactions expose declining protection on situational or induced risks and iteratively construct higher-challenge safety data.Questions and follow-ups are sampled, answered by models, risk-scored, integrated when unsafe, or rewritten for further iteration when safe.Source: Adversarial question and follow-up… · p. 4, Figure 4 · p. 5

Automated vs. Human Assessment Consistency

Assessment Methodology

  • Specially trained assessor models grade responses from 0 for risky to 2 for safe, reasonable, and informative, while severe illegal or sensitive replies remain 0.The benchmark evaluates whether safety is maintained consistently across conversational rounds.Source: Assessment Methodology · p. 5

Dataset Statistics

  • The dataset contains 4912 adversarially augmented question pairs spanning 20+ safety sub-dimensions, with 80–120 pairs per sub-dimension.Source: Dataset Statistics · p. 5

3 Model Evaluation

The evaluation compares 13 Chinese-supporting LLMs across overall safety, traditional safety, responsible AI, and instruction attacks, including round-to-round robustness. Closed-source models generally lead, while some smaller and domestic models remain competitive.

  • Closed-source models generally outperform open-sourced models in safety and occupy top ranks in overall and per-capability scores.Source: §3 · pp. 5–6, Table 3 · p. 6
  • Domestic LLMs are on par with GPT-3.5-turbo in safety, with the paper attributing this to understanding Chinese regulations and ethics.Source: §3 · p. 6
  • Smaller 6B-13B LLMs can be competitive with models containing hundreds of billions of parameters.Qwen-7B-Chat was within 5.3 points of GPT-3.5-turbo on Traditional Safety, while ChatGLM2-6B was within 3.2 points on Instruction Attacks.Source: §3 · p. 6, Table 6 · p. 7, Table 8 · p. 7
  • GPT-4 excels across Traditional Safety, Responsible AI, and Instruction Attacks and ranks first overall.Source: §3 · p. 6, Table 3 · p. 6
  • Most models decline from Round 1 to Round 2, whereas ChatGLM2, MiniMax, and OpenBuddy 70B show relatively consistent performance.The benchmark uses challenging follow-up questions to test multi-round robustness.Source: Table 4 · p. 6, §3 · p. 6

4 Related Work

Related benchmarks assess Chinese language abilities and LLM safety, but existing safety evaluations largely use single-turn open-ended or multiple-choice questions. SC-Safety targets multi-turn open-ended safety in challenging interactive scenarios.

  • Existing Chinese benchmarks include C-Eval, CLUE, and SuperCLUE, covering disciplines, common NLP tasks, and multi-round open-ended questions.Source: §4 · p. 7
  • Safety-Prompts evaluates typical security and instruction attacks with single-turn open-ended questions, while SafetyBench uses multiple-choice questions.Source: §4 · p. 7
  • CValues adds responsibility to safety evaluation but still relies on multiple-choice questions and attempts automatic assessment.Source: §4 · p. 7
  • SC-Safety is motivated by the lack of realistic multi-turn open-ended evaluations with challenging questions.Source: §4 · p. 7

5 Conclusion

SC-Safety combines adversarial human-model interactions with multi-turn open-ended questions to evaluate traditional safety, responsible AI, and instruction-attack robustness. Experiments reveal systematic model differences and motivate safer, more trustworthy LLM development.

  • SC-Safety provides a comprehensive, challenging benchmark using adversarial interactions and multi-turn open-ended questions beyond traditional safety evaluation.Source: §5 · p. 7
  • Closed-source models generally outperform open-sourced models, domestic models are comparable to GPT-3.5-turbo, and some 6B-13B models remain competitive.Source: §5 · p. 7
  • Most models lose performance from Round 1 to Round 2, while some maintain consistency and show higher robustness.Source: §5 · p. 8
  • The benchmark and empirical findings aim to support collaboration on safer, more trustworthy LLMs and guide model selection for real-world applications.Future work is described as expanding coverage, model scope, assessment accuracy, and benchmark design.Source: §5 · p. 8

A Examples for Assessment Dimensions

The examples illustrate that models may generate potentially risky content in response to user questions and follow-up questions across different aspects and directions.

Robustness against instruction attacks

The examples span traditional safety, responsible AI, and instruction attacks, including harmful requests involving physical harm, crime, relationships, animal use, and illicit activities. Several responses provide procedural guidance despite acknowledging ethical or legal risks, illustrating varied unsafe-content scenarios.

Robustness against instruction attacks

  • The figures organize examples under privacy and property, physical harm, crimes and illegal activities, ethics and morality, social harmony, psychology, intimate relationships, and instruction-attack categories.Source: Figure 5 · p. 9, Figure 6 · p. 10, Figure 7 · p. 11

Traditional safety

Responsible AI

Traditional safety

Instruction attacks

Related papers

Loading 2310.05818v1…