Badllama 3: removing safety finetuning from Llama 3 in minutes

2024/07/01 by Volkov, Dmitrii · 1 citation
#Artificial Intelligence (cs.AI) #Computation and Language (cs.CL) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG)

paper · doi:10.48550/arxiv.2407.01376

Abstract

We show that extensive LLM safety fine-tuning is easily subverted when an attacker has access to model weights. We evaluate three state-of-the-art fine-tuning methods-QLoRA, ReFT, and Ortho-and show how algorithmic advances enable constant jailbreaking performance with cuts in FLOPs and optimisation power. We strip safety fine-tuning from Llama 3 8B in one minute and Llama 3 70B in 30 minutes on a single GPU, and sketch ways to reduce this further.

Cited by

• SoK: Taxonomy and Evaluation of Prompt Security in Large Language Models

Related

• Attack via Overfitting: 10-shot Benign Fine-tuning to Jailbreak LLMs
• You Can't Eat Your Cake and Have It Too: The Performance Degradation of LLMs with Jailbreak Defense
• BadGPT-4o: stripping safety finetuning from GPT models
• PrisonBreak: Jailbreaking Large Language Models with at Most Twenty-Five Targeted Bit-flips
• Iterative Self-Tuning LLMs for Enhanced Jailbreaking Capabilities