PatchBench: Measuring Collateral Damage in Activation Patching
PatchBench checks whether LLM jailbreak repairs fix nearby harmful prompts without over-refusing similar benign ones.
PatchBench measures whether an LLM safety patch fixes a specific jailbreak without changing nearby behavior. From 27,870 prompts in 37 datasets, the authors curate 15,314 English prompts, query eight open-source instruction-tuned models, and retain 400 high-confidence failures after WildGuard filtering, Elo ranking, and manual review. PatchBench-Local generates harmful variants, structure-matched benign prompts, and benign prompts that reuse harmful terms. Evaluating four activation-steering methods shows MMLU can stay nearly unchanged while local benign regressions are severe.
- 400 jailbreak failures curated from 27,870 prompts and eight models
- Local neighbors test harmful correction against benign preservation
- Four steering methods keep MMLU while causing severe local over-refusal
- Aggregate attack-success and capability scores miss that collateral damage
- Products
- PatchBenchWildGuardMMLU
From the original article
1 min read at arxiv.orgAn LLM safety patch can pass a benchmark while still being a poor repair. This risk is especially acute for jailbreak repairs, where the goal is to correct a specific unsafe behaviour without changing unrelated behaviours. A patch may block exact evaluation prompts yet fail on close harmful variants, or suppress harmful behaviour by over-refusing benign prompts that share its wording or structure.
By Alexi Canesse · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.