Update README.md

README.md

@@ -1,84 +1,84 @@
----
-license: cc-by-nc-4.0
-task_categories:
- - text-generation
-language:
- - en
-tags:
- - adversarial robustness
- - human red teaming
----
-
-<style>
- button {
- /* margin: calc(20vw / 100); */
- margin: 0.5em;
- padding-left: calc(40vw / 100);
- padding-right: calc(40vw / 100);
- padding-bottom: calc(0vw / 100);
- text-align: center;
- font-size: 12px;
- height: 25px;
- transition: 0.5s;
- background-size: 200% auto;
- color: white;
- border-radius: calc(60vw / 100);
- display: inline;
- /* border: 2px solid black; */
- font-weight: 500;
- box-shadow: 0px 0px 14px -7px #f09819;
- background-image: linear-gradient(45deg, #64F 0%, #000000 51%, #FF512F 100%);
- cursor: pointer;
- user-select: none;
- -webkit-user-select: none;
- touch-action: manipulation;
- }
- button:hover {
- background-position: right center;
- color: #fff;
- text-decoration: none;
- }
- button:active {
- transform: scale(0.95);
- }
-</style>
-
-# Model Card for Llama3-8B-RMU
-
-<a href="https://scale.com/research/mhj" style="text-decoration:none">
- <button>Homepage</button>
-</a>
-<a href="https://huggingface.co/datasets/ScaleAI/mhj" style="text-decoration:none">
- <button>Dataset</button>
-</a>
-
-This card contains the RMU model `Llama3-8B-RMU` used in *LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks*. 
-
-## Paper Abstract
-
-Recent large language model (LLM) defenses have greatly improved models’ ability to refuse harmful
-queries, even when adversarially attacked. However, LLM defenses are primarily evaluated against
-automated adversarial attacks in a single turn of conversation, an insufficient threat model for real-
-world malicious use. We demonstrate that multi-turn human jailbreaks uncover significant vulnerabilities,
-exceeding 70% attack success rate (ASR) on HarmBench against defenses that report single-digit ASRs
-with automated single-turn attacks. Human jailbreaks also reveal vulnerabilities in machine unlearning
-defenses, successfully recovering dual-use biosecurity knowledge from unlearned models. We compile
-these results into Multi-Turn Human Jailbreaks (MHJ), a dataset of 2,912 prompts across 537 multi-turn
-jailbreaks. We publicly release MHJ alongside a compendium of jailbreak tactics developed across dozens
-of commercial red teaming engagements, supporting research towards stronger LLM defenses.
-
-## RMU (Representation Misdirection for Unlearning) Model
-
-For the [WMDP-Bio](https://www.wmdp.ai/) evaluation, we employ the RMU unlearning method. The original
-paper applies [RMU](https://arxiv.org/abs/2403.03218) upon the zephyr-7b-beta model, but to standardize defenses and use a more
-performant model, we apply RMU upon llama-3-8b-instruct, the same base model as all other defenses
-in this paper. We conduct a hyperparameter search upon batches ∈ {200, 400}, c ∈ {5, 20, 50, 200},
-α ∈ {200, 500, 2000, 5000}, lr ∈ {2 × 10−5, 5 × 10−5, 2 × 10−4}. We end up selecting batches = 400,
-c = 50, α = 5000, lr = 2 × 10−4, and retain the hyperparameters layer_ids = [5, 6, 7] and param_ids
-= [6] from [Li et al.]((https://arxiv.org/abs/2403.03218)) We validate our results in Figure 8, demonstrating reduction in WMDP
-performance but retention of general capabilities (MMLU)
-
-The following picture shows LLaMA-3-8B-instruct multiple choice benchmark accuracies before and after RMU.
-
-![](rmu_result.png)
-
+---
+license: cc-by-nc-4.0
+task_categories:
+- text-generation
+language:
+- en
+tags:
+- adversarial robustness
+- human red teaming
+base_model: meta-llama/Meta-Llama-3-8B-Instruct
+---
+
+<style>
+ button {
+ /* margin: calc(20vw / 100); */
+ margin: 0.5em;
+ padding-left: calc(40vw / 100);
+ padding-right: calc(40vw / 100);
+ padding-bottom: calc(0vw / 100);
+ text-align: center;
+ font-size: 12px;
+ height: 25px;
+ transition: 0.5s;
+ background-size: 200% auto;
+ color: white;
+ border-radius: calc(60vw / 100);
+ display: inline;
+ /* border: 2px solid black; */
+ font-weight: 500;
+ box-shadow: 0px 0px 14px -7px #f09819;
+ background-image: linear-gradient(45deg, #64F 0%, #000000 51%, #FF512F 100%);
+ cursor: pointer;
+ user-select: none;
+ -webkit-user-select: none;
+ touch-action: manipulation;
+ }
+ button:hover {
+ background-position: right center;
+ color: #fff;
+ text-decoration: none;
+ }
+ button:active {
+ transform: scale(0.95);
+ }
+</style>
+
+# Model Card for Llama3-8B-RMU
+
+<a href="https://scale.com/research/mhj" style="text-decoration:none">
+ <button>Homepage</button>
+</a>
+<a href="https://huggingface.co/datasets/ScaleAI/mhj" style="text-decoration:none">
+ <button>Dataset</button>
+</a>
+
+This card contains the RMU model `Llama3-8B-RMU` used in *LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks*. 
+
+## Paper Abstract
+
+Recent large language model (LLM) defenses have greatly improved models’ ability to refuse harmful
+queries, even when adversarially attacked. However, LLM defenses are primarily evaluated against
+automated adversarial attacks in a single turn of conversation, an insufficient threat model for real-
+world malicious use. We demonstrate that multi-turn human jailbreaks uncover significant vulnerabilities,
+exceeding 70% attack success rate (ASR) on HarmBench against defenses that report single-digit ASRs
+with automated single-turn attacks. Human jailbreaks also reveal vulnerabilities in machine unlearning
+defenses, successfully recovering dual-use biosecurity knowledge from unlearned models. We compile
+these results into Multi-Turn Human Jailbreaks (MHJ), a dataset of 2,912 prompts across 537 multi-turn
+jailbreaks. We publicly release MHJ alongside a compendium of jailbreak tactics developed across dozens
+of commercial red teaming engagements, supporting research towards stronger LLM defenses.
+
+## RMU (Representation Misdirection for Unlearning) Model
+
+For the [WMDP-Bio](https://www.wmdp.ai/) evaluation, we employ the RMU unlearning method. The original
+paper applies [RMU](https://arxiv.org/abs/2403.03218) upon the zephyr-7b-beta model, but to standardize defenses and use a more
+performant model, we apply RMU upon llama-3-8b-instruct, the same base model as all other defenses
+in this paper. We conduct a hyperparameter search upon batches ∈ {200, 400}, c ∈ {5, 20, 50, 200},
+α ∈ {200, 500, 2000, 5000}, lr ∈ {2 × 10−5, 5 × 10−5, 2 × 10−4}. We end up selecting batches = 400,
+c = 50, α = 5000, lr = 2 × 10−4, and retain the hyperparameters layer_ids = [5, 6, 7] and param_ids
+= [6] from [Li et al.]((https://arxiv.org/abs/2403.03218)) We validate our results in Figure 8, demonstrating reduction in WMDP
+performance but retention of general capabilities (MMLU)
+
+The following picture shows LLaMA-3-8B-instruct multiple choice benchmark accuracies before and after RMU.
+
+![](rmu_result.png)