No, of Course I Can! Deeper Fine-Tuning Attacks That Bypass Token-Level Safety Mechanisms

Antidote: Understanding and defending against poisoning of anomaly detectors

Rubinstein, B., Nelson, B., Huang, L., Joseph, A. D., Lau, S., Rao, S., Taft, N., and Tygar, J · 2009

Earlier work this paper cites.

How much spam can you take? an analysis of crowdsourcing results to increase accuracy

Vuurens, J., de Vries, A. P., and Eickhoff, C · 2011

Earlier work this paper cites.

Adversarial support vector machine learning

Zhou, Y., Kantarcioglu, M., Thuraisingham, B., and Xi, B · 2012

Earlier work this paper cites.

Is data clustering in adversarial settings secure?

Biggio, B., Pillai, I., Bulò, S. R., Ariu, D., Pelillo, M., and Roli, F · 2013

Earlier work this paper cites.

Poisoning complete-linkage hierarchical clustering

Biggio, B., Rota, B. S., Ignazio, P., Michele, M., Zemene, M. E., Marcello, P., and Fabio, R · 2014

Earlier work this paper cites.

The security of latent dirichlet allocation

Mei, S. and Zhu, X · 2015

Earlier work this paper cites.

Systematic poisoning attacks on and defenses for machine learning in healthcare

Mozaffari-Kermani, M., Sur-Kolay, S., Raghunathan, A., and Jha, N. K · 2015

Earlier work this paper cites.

Is feature selection secure against training data poisoning?

Xiao, H., Biggio, B., Brown, G., Fumera, G., Eckert, C., and Roli, F · 2015

Earlier work this paper cites.

Data poisoning attacks on factorization-based collaborative filtering

Li, B., Wang, Y., Singh, A., and Vorobeychik, Y · 2016

Earlier work this paper cites.

Combating Attacks and Abuse in Large Online Communities

Wang, G · 2016

Earlier work this paper cites.

Certified defenses for data poisoning attacks

Steinhardt, J., Koh, P. W., and Liang, P · 2017

Earlier work this paper cites.

A multi-dimensional machine learning approach to predict advanced malware

Bahtiyar, Ş., Yaman, M. B., and Altıniğne, C. Y · 2019

Earlier work this paper cites.

A survey of attacks against twitter spam detectors in an adversarial environment

Imam, N. H. and Vassilakis, V. G · 2019

Earlier work this paper cites.

A benchmark study of backdoor data poisoning defenses for deep neural network classifiers and a novel defense

Xiang, Z., Miller, D. J., and Kesidis, G · 2019

Earlier work this paper cites.

RealToxicityPrompts: Evaluating neural toxic degeneration in language models

Gehman, S., Gururangan, S., Sap, M., Choi, Y., and Smith, N. A · 2020

Earlier work this paper cites.

Exploring data and model poisoning attacks to deep learning-based nlp systems

Marulli, F., Verde, L., and Campanile, L · 2021

Earlier work this paper cites.

Challenges in detoxifying language models, 2021

Original

Welbl, J., Glaese, A., Uesato, J., Dathathri, S., Mellor, J., Hendricks, L. A., Anderson, K., Kohli, P., Coppin, B., and Huang, P.-S · 2021

Earlier work this paper cites.

Training a helpful and harmless assistant with reinforcement learning from human feedback, 2022

Original

Bai, Y., Jones, A., Ndousse, K., Askell, A., Chen, A., DasSarma, N., Drain, D., Fort, S., Ganguli, D., Henighan, T., Joseph, N., Kadavath, S., Kernion, J., Conerly, T., El-Showk, S., Elhage, N., Hatfield-Dodds, Z., Hernandez, D., Hume, T., Johnston, S., Kravec, S., Lovitt, L., Nanda, N., Olsson, C., Amodei, D., Brown, T., Clark, J., McCandlish, S., Olah, C., Mann, B., and Kaplan, J · 2022

Earlier work this paper cites.

Truth serum: Poisoning machine learning models to reveal their secrets

Tramèr, F., Shokri, R., San Joaquin, A., Le, H., Jagielski, M., Hong, S., and Carlini, N · 2022

Earlier work this paper cites.

Not all poisons are created equal: Robust training against data poisoning

Yang, Y., Liu, T. Y., and Mirzasoleiman, B · 2022

Earlier work this paper cites.

Are aligned neural networks adversarially aligned?

Carlini, N., Nasr, M., Choquette-Choo, C. A., Jagielski, M., Gao, I., Koh, P. W., Ippolito, D., Tramèr, F., and Schmidt, L · 2023

Earlier work this paper cites.

Call for ai pause highlights potential dangers

Clarke, L · 2023

Earlier work this paper cites.

Llama guard: Llm-based input-output safeguard for human-ai conversations, 2023

Original

Inan, H., Upasani, K., Chi, J., Rungta, R., Iyer, K., Mao, Y., Tontchev, M., Hu, Q., Fuller, B., Testuggine, D., and Khabsa, M · 2023

Earlier work this paper cites.

Mistral 7b, 2023

Original

Jiang, A. Q., Sablayrolles, A., Mensch, A., Bamford, C., Chaplot, D. S., de las Casas, D., Bressand, F., Lengyel, G., Lample, G., Saulnier, L., Lavaud, L. R., Lachaux, M.-A., Stock, P., Scao, T. L., Lavril, T., Wang, T., Lacroix, T., and Sayed, W. E · 2023

Earlier work this paper cites.

Generative ai as a dangerous new form of media

Rosenberg, L · 2023

Earlier work this paper cites.

The dangers of generative artificial intelligence

Tredinnick, L. and Laybats, C · 2023

Earlier work this paper cites.

Poisoning language models during instruction tuning

Wan, A., Wallace, E., Shen, S., and Klein, D · 2023

Earlier work this paper cites.

Temporal robustness against data poisoning

Wang, W. and Feizi, S · 2023

Earlier work this paper cites.

Helpsteer: Multi-attribute helpfulness dataset for steerlm, 2023

Original

Wang, Z., Dong, Y., Zeng, J., Adams, V., Sreedhar, M. N., Egert, D., Delalleau, O., Scowcroft, J. P., Kant, N., Swope, A., and Kuchaiev, O · 2023

Cited alongside, same era.

Jailbroken: How does LLM safety training fail?

Wei, A., Haghtalab, N., and Steinhardt, J · 2023

Cited alongside, same era.

Shadow alignment: The ease of subverting safely-aligned language models, 2023

Original

Yang, X., Wang, X., Zhang, Q., Petzold, L., Wang, W. Y., Zhao, X., and Lin, D · 2023

Cited alongside, same era.

Removing rlhf protections in gpt-4 via fine-tuning

Zhan, Q., Fang, R., Bindu, R., Gupta, A., Hashimoto, T., and Kang, D · 2023

Cited alongside, same era.

The real dangers of generative ai

Allen, D. and Weyl, E. G · 2024

Cited alongside, same era.

Seal: Safety-enhanced aligned llm fine-tuning via bilevel data selection, 2024

Original

Shen, H., Chen, P.-Y., Das, P., and Chen, T · 2024

Later among the works it cites.

On the exploitability of instruction tuning

Shu, M., Wang, J., Zhu, C., Geiping, J., Xiao, C., and Goldstein, T · 2024

Later among the works it cites.

Tamper-resistant safeguards for open-weight llms

Original

Tamirisa, R., Bharathi, B., Phan, L., Zhou, A., Gatti, A., Suresh, T., Lin, M., Wang, J., Wang, R., Arel, R., et al · 2024

Later among the works it cites.

Gemma: Open models based on gemini research and technology, 2024

Original

Team, G., Mesnard, T., Hardin, C., Dadashi, R., Bhupatiraju, S., Pathak, S., Sifre, L., Rivière, M., Kale, M. S., Love, J., Tafti, P., Hussenot, L., Sessa, P. G., Chowdhery, A., Roberts, A., Barua, A., Botev, A., Castro-Ros, A., Slone, A., Héliou, A., Tacchetti, A., Bulanova, A., Paterson, A., Tsai, B., Shahriari, B., Lan, C. L., Choquette-Choo, C. A., Crepy, C., Cer, D., Ippolito, D., Reid, D., Buchatskaya, E., Ni, E., Noland, E., Yan, G., Tucker, G., Muraru, G.-C., Rozhdestvenskiy, G., Michalewski, H., Tenney, I., Grishchenko, I., Austin, J., Keeling, J., Labanowski, J., Lespiau, J.-B., Stanway, J., Brennan, J., Chen, J., Ferret, J., Chiu, J., Mao-Jones, J., Lee, K., Yu, K., Millican, K., Sjoesund, L. L., Lee, L., Dixon, L., Reid, M., Mikuła, M., Wirth, M., Sharman, M., Chinaev, N., Thain, N., Bachem, O., Chang, O., Wahltinez, O., Bailey, P., Michel, P., Yotov, P., Chaabouni, R., Comanescu, R., Jana, R., Anil, R., McIlroy, R., Liu, R., Mullins, R., Smith, S. L., Borgeaud, S., Girgin, S., Douglas, S., Pandya, S., Shakeri, S., De, S., Klimenko, T., Hennigan, T., Feinberg, V., Stokowiec, W., hui Chen, Y., Ahmed, Z., Gong, Z., Warkentin, T., Peran, L., Giang, M., Farabet, C., Vinyals, O., Dean, J., Kavukcuoglu, K., Hassabis, D., Ghahramani, Z., Eck, D., Barral, J., Pereira, F., Collins, E., Joulin, A., Fiedel, N., Senter, E., Andreev, A., and Kenealy, K · 2024