BEAST Attack Implementation #728

erickgalinkin · 2024-06-06T14:24:55Z

Add BEAST attack; add resources/common; refactor to use common. Remove advbench data.

…Create resources.common with commonly used attributes. Fix typo in generate_gcg.py. Rename gcg.py to suffix.py to encompass other similar attacks.

… Refactor gcg to use new functionality.

…s bars. Catch case where advbench directory doesn't exist.

jmartin-tech

Some early review thoughts.

garak/resources/common.py

garak/resources/autodan/autodan.py

garak/resources/beast/beast_attack.py

garak/probes/suffix.py

jmartin-tech · 2024-06-07T20:07:54Z

garak/probes/suffix.py

+
+        try:
+            beast_output = self.run_beast(target_generator=self.generator)
+        except Exception as e:


Love that there is error handling here.

Can this be more specific in the Exception types captured? Consider using GarakException and having any generated exceptions in the utility inherit.

garak/resources/beast/__init__.py

garak/resources/beast/beast_attack.py

garak/resources/common.py

…unction and catch case where tokenizer does not support. Fix get_perplexity. Fix evaluate. Add score_candidates function. Apply black.

…emove duplicate invocation of `Path`. Denote methods in beast_attack.py as private. Fix _evaluate method to deal with generator returns properly.

jmartin-tech

Nice progress, a suggestion for code reuse and some minor thoughts. No required revisions that I see although some more testing to be done.

garak/resources/beast/data/suffixes.txt

jmartin-tech · 2024-06-18T19:14:05Z

garak/resources/beast/beast_attack.py

+    suffix_len: int = 40,
+    data_size: int = 20,
+    target: Optional[str] = "",
+    outfile: str = beast_resource_data / "suffixes.txt",


This default location is inside the installed path, I would suggest this should be either in the OS temp directory or a user's profile/configuration directory.

This is likely a reasonable choice to get this PR staged and landed, tagging #479 to note location that may need update.

one temp solution is something like garak._config.reporting.report_dir / "garak." + garak._config.transient.run_id + ".beast_suffixes.txt"

jmartin-tech · 2024-06-18T19:17:39Z

garak/resources/beast/beast_attack.py

+    "A chat between a curious user and an artificial intelligence assistant. "
+    "The assistant gives helpful, detailed, and polite answers to the user's questions."
+)
+beast_resource_data = garak._config.transient.basedir / "resources" / "beast" / "data"


Suggested change

beast_resource_data = garak._config.transient.basedir / "resources" / "beast" / "data"

resource_beast_data = garak._config.transient.basedir / "resources" / "beast" / "data"

Nitpick, it seems reasonable to have the name match the path is selects. May become a moot point depending on long term location for staging file.

This var name reads weirdly to me, but I get it. I think once we get #479 squared away, it's likely a moot point.

garak/probes/suffix.py

jmartin-tech · 2024-06-18T19:29:19Z

garak/resources/common.py

+    advbench_path = (
+        garak._config.transient.basedir
+        / "resources"
+        / "advbench"
+        / "harmful_behaviors.csv"
+    )


Another location reference for #479

this I think is a static resource that comes with garak, rather than data that will be modified

@erickgalinkin what's the license on this data btw?

MIT license: https://github.com/llm-attacks/llm-attacks/tree/main?tab=MIT-1-ov-file

jmartin-tech · 2024-06-18T19:31:10Z

garak/resources/gcg/generate_gcg.py

@@ -36,7 +37,7 @@

 logger = getLogger(__name__)

-gpg_resource_data = garak._config.transient.basedir / "resources" / "gcg" / "data"
+gcg_resource_data = garak._config.transient.basedir / "resources" / "gcg" / "data"


Suggested change

gcg_resource_data = garak._config.transient.basedir / "resources" / "gcg" / "data"

resource_gcg_data = garak._config.transient.basedir / "resources" / "gcg" / "data"

Another nitpick, just seems reasonable to match name to path.

Again, going to defer this change to #479

leondz

excellent effort, i can't believe we're getting BEAST in, that is extremely cool. just a few structural suggestions and questions.

garak/resources/beast/__init__.py

garak/probes/suffix.py

garak/resources/beast/beast_attack.py

leondz · 2024-06-19T06:47:07Z

garak/resources/beast/beast_attack.py

+    jailbreak = False
+    for output in outputs:
+        if not any([rs in output[0] for rs in REJECTION_STRINGS]):
+            jailbreak = True


detecting absence of mitigation well is a difficult task, eh. does this mean the detector should be predicated on REJECTION_STRINGS else we might have a bad time?

That's right. If only we had a better mitigation detector.

We could, theoretically, use LLM as a judge or whatever. May even be able to simply wrap in the MitigationDetector instead, but this is pretty lightweight. Definitely want to square REJECTION_STRINGS and the MitigationDetector when we start work on those.

garak/resources/beast/beast_attack.py

leondz · 2024-06-19T07:07:54Z

garak/resources/beast/beast_attack.py

+    suffix_len: int = 40,
+    data_size: int = 20,
+    target: Optional[str] = "",
+    outfile: str = beast_resource_data / "suffixes.txt",


one temp solution is something like garak._config.reporting.report_dir / "garak." + garak._config.transient.run_id + ".beast_suffixes.txt"

leondz · 2024-06-19T07:08:50Z

garak/resources/common.py

+    advbench_path = (
+        garak._config.transient.basedir
+        / "resources"
+        / "advbench"
+        / "harmful_behaviors.csv"
+    )


this I think is a static resource that comes with garak, rather than data that will be modified

@erickgalinkin what's the license on this data btw?

leondz · 2024-06-19T07:09:45Z

garak/resources/common.py

+        except pd.errors.ParserError as e:
+            msg = f"Failed to parse the csv at {hb}"
+            logging.error(msg)
+            raise pd.errors.ParserError
+        except urllib.error.HTTPError as e:
+            msg = f"Encountered error {e} trying to retrieve {hb}"
+            logging.error(msg)
+            raise urllib.error.HTTPError


Do these stop the garak run? Would be preferable for probe() to just return []

We may want to raise GarakException here instead so we can handle it more gracefully?

Looks like upstream of everywhere load_advbench is currently used in a probe, it's already wrapped in a try/except block that'll handle the error gracefully -- log the error, print the error encountered, and register that there was no output from the generation attempt, so it won't stop the run.

Co-authored-by: Jeffrey Martin <jemartin@nvidia.com> Signed-off-by: Erick Galinkin <erick.galinkin@gmail.com>

Fix copyright date Co-authored-by: Leon Derczynski <leonderczynski@gmail.com> Signed-off-by: Erick Galinkin <erick.galinkin@gmail.com>

Co-authored-by: Leon Derczynski <leonderczynski@gmail.com> Signed-off-by: Erick Galinkin <erick.galinkin@gmail.com>

Add description to progress bar. Co-authored-by: Leon Derczynski <leonderczynski@gmail.com> Signed-off-by: Erick Galinkin <erick.galinkin@gmail.com>

leondz · 2024-06-25T06:14:44Z

garak/resources/beast/beast_attack.py

+        if logs is not None:
+            logs += log
+        else:
+            logs = log


Just trying to work out how to skip the conditional, but it's a marginal optimisation

jmartin-tech

A syntax error is currently generated when running the suffix.BEAST probe.

  File "/garak/garak/probes/suffix.py", line 154, in probe
    self.prompts = [self.goal + beast_output]
...
TypeError: can only concatenate str (not "list") to str```

garak/probes/suffix.py

Co-authored-by: Jeffrey Martin <jemartin@nvidia.com> Signed-off-by: Erick Galinkin <erick.galinkin@gmail.com>

erickgalinkin added 2 commits June 6, 2024 09:59

Add BEAST attack implementation. Move gcg.txt out of its own folder. …

1a4eda6

…Create resources.common with commonly used attributes. Fix typo in generate_gcg.py. Rename gcg.py to suffix.py to encompass other similar attacks.

Remove advbench data. Create function to download/load advbench data.…

822537f

… Refactor gcg to use new functionality.

erickgalinkin linked an issue Jun 6, 2024 that may be closed by this pull request

probe: BEAST / Fast Adversarial Attacks on Language Models In One GPU Minute #530

Closed

Add chat templating and system prompt to beast_attack.py. Add progres…

ffa0334

…s bars. Catch case where advbench directory doesn't exist.

jmartin-tech marked this pull request as draft June 7, 2024 14:18

jmartin-tech reviewed Jun 7, 2024

View reviewed changes

erickgalinkin added 2 commits June 10, 2024 10:15

Add size parameter to load_advbench() in common.py. Add format_chat f…

a7d6d11

…unction and catch case where tokenizer does not support. Fix get_perplexity. Fix evaluate. Add score_candidates function. Apply black.

Rename rejection_strings using CONSTANT variable naming convention. R…

7212c68

…emove duplicate invocation of `Path`. Denote methods in beast_attack.py as private. Fix _evaluate method to deal with generator returns properly.

erickgalinkin marked this pull request as ready for review June 10, 2024 20:53

erickgalinkin requested review from jmartin-tech and leondz June 10, 2024 20:53

erickgalinkin added 3 commits June 10, 2024 16:55

Replace print statement with logging.

766ada9

Rename garak.probes.gcg.rst to garak.probes.suffix.rst.

ac64624

Fix rename in docs; rename SUFFIX_PATH to GCG_SUFFIX_PATH in suffix.py

0138edf

jmartin-tech reviewed Jun 18, 2024

View reviewed changes

leondz reviewed Jun 19, 2024

View reviewed changes

erickgalinkin and others added 4 commits June 24, 2024 11:40

Update garak/probes/suffix.py

98d4314

Co-authored-by: Jeffrey Martin <jemartin@nvidia.com> Signed-off-by: Erick Galinkin <erick.galinkin@gmail.com>

Update garak/resources/beast/__init__.py

a9729aa

Fix copyright date Co-authored-by: Leon Derczynski <leonderczynski@gmail.com> Signed-off-by: Erick Galinkin <erick.galinkin@gmail.com>

Update garak/resources/beast/beast_attack.py

38aa7bb

Co-authored-by: Leon Derczynski <leonderczynski@gmail.com> Signed-off-by: Erick Galinkin <erick.galinkin@gmail.com>

Update garak/resources/beast/beast_attack.py

8921650

Add description to progress bar. Co-authored-by: Leon Derczynski <leonderczynski@gmail.com> Signed-off-by: Erick Galinkin <erick.galinkin@gmail.com>

leondz approved these changes Jun 25, 2024

View reviewed changes

Relocate imports to reduce load cost.

f0ef051

jmartin-tech requested changes Jun 26, 2024

View reviewed changes

garak/probes/suffix.py Outdated Show resolved Hide resolved

Update garak/probes/suffix.py

6a0c129

Co-authored-by: Jeffrey Martin <jemartin@nvidia.com> Signed-off-by: Erick Galinkin <erick.galinkin@gmail.com>

jmartin-tech approved these changes Jun 27, 2024

View reviewed changes

jmartin-tech merged commit 96de942 into main Jun 28, 2024
6 checks passed

jmartin-tech deleted the 530-probe-beast-fast-adversarial-attacks-on-language-models-in-one-gpu-minute branch June 28, 2024 13:58

github-actions bot locked and limited conversation to collaborators Jun 28, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

BEAST Attack Implementation #728

BEAST Attack Implementation #728

erickgalinkin commented Jun 6, 2024

jmartin-tech left a comment

jmartin-tech Jun 7, 2024

jmartin-tech left a comment

jmartin-tech Jun 18, 2024

leondz Jun 19, 2024

jmartin-tech Jun 18, 2024

erickgalinkin Jun 24, 2024

jmartin-tech Jun 18, 2024

leondz Jun 19, 2024

erickgalinkin Jun 24, 2024

jmartin-tech Jun 18, 2024

erickgalinkin Jun 24, 2024

leondz left a comment

leondz Jun 19, 2024

erickgalinkin Jun 24, 2024

leondz Jun 19, 2024

leondz Jun 19, 2024

leondz Jun 19, 2024

erickgalinkin Jun 24, 2024

erickgalinkin Jun 24, 2024

leondz Jun 25, 2024

jmartin-tech left a comment

	beast_resource_data = garak._config.transient.basedir / "resources" / "beast" / "data"
	resource_beast_data = garak._config.transient.basedir / "resources" / "beast" / "data"

	gcg_resource_data = garak._config.transient.basedir / "resources" / "gcg" / "data"
	resource_gcg_data = garak._config.transient.basedir / "resources" / "gcg" / "data"

BEAST Attack Implementation #728

BEAST Attack Implementation #728

Conversation

erickgalinkin commented Jun 6, 2024

jmartin-tech left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jmartin-tech left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

leondz left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jmartin-tech left a comment

Choose a reason for hiding this comment