Meta Llama

Responsible
Use Guide
Resources and best practices forresponsible development of products
built with large language models

Contents
Open Innovation							

1How to use this guide						

3Overview of responsible AI & system design				4

Responsible AI considerations				4

Mitigation points for LLM-powered products

5

Development of the foundation model				6

Responsible LLM product development stages			

7

Determine use case						7

		Define content policies 						8

		Understand alignment-helpfulness trade-offs			8

Model-level alignment							 9Step 1: Prepare data			

10

Step 2: Train the model						11

		Reinforcement Learning from Human Feedback (RLHF)

12		

Reinforcement Learning from AI Feedback (RLAIF)

12

Step 3: Evaluate and improve performance 			12		Red teaming best practices				13

		Privacy adversarial attacks				

14

System-level alignment				14

		Mitigating risks at the input level				15

		

Mitigating risks at the output level		

16

Evaluate effectiveness 					
		

17Build transparency and reporting mechanisms
in user interactions						

17Feedback & reporting mechanisms 			

17

Transparency & control best practices 			

18

Resources for developers						

19Combining the components of responsible generative AI		21

Addendum: Introducing Code Llama		

22Foundation model use case				23

Instruction model use case				25

Meta is committed to open science because
we believe that a vibrant AI-innovation
ecosystem will push the frontiers of scientificdiscovery and potentially revolutionize a widearray of sectors from education to agriculture,and climate management to cybersecurity.
We believe that the power of AI will be harnessed to address global
challenges, and unlocking that power responsibly will requiredemocratization of access and collaboration on risk management.
We want to empower developers in every industry on a global
scale to drive breakthroughs, create new products and solutions,and benefit from accelerations in technological advancement andeconomic growth.

AI at Meta

April 2024

1

Meta has open sourced code and datasets for

Meta is proud to have supported the Llama 2 developermachine translation, computer vision, and fairness

community by building state-of-the-art responsibility

evaluation, while contributing to the infrastructure

tooling that makes it easier than ever to build and releaseof the AI-developer community with tools likemodels responsibly. Learn more about the open source

PyTorch, ONNX, Glow, and Detectron. In the past,

tools we share with developers to help them build

we have also made our cutting-edge large language

responsibly.

models (LLMs) Llama 1 and OPT-175B available tothe scientific community through research releases
which have spurred research in model efficiency,
medicine, and conversational safety studies on
evaluation methods, de-biasing techniques, andsources of hallucinations in LLMs.

We’re also excited to release an early look at the next
generation of Llama, Meta Llama 3 which, like Llama 2,
is licensed for commercial use. This release of
Llama 3 features both 8B and 70B pretrained andinstruct fine-tuned versions to help support a broad
range of application environments.

We also took an important step toward advancing
access and opportunity in the creation of AI-powered
products and experiences with the launch of Meta
Llama 2. The open release of these models to theresearch and business community laid the foundation
for the next wave of community-driven innovation in
generative AI. We’ve seen an incredible responsethus far with millions of download requests in thetime since its release.

We envision Llama models
as part of a broader systemthat puts the developer in thedriver seat.
Llama models will serve as the foundational piece ofa complex system that developers design with their

Democratization of access will put these models

unique end goals in mind. As part of this system

in more people’s hands, which we believe is thecentric approach, and to support responsible

right path to ensure that this technology will benefit

deployment of these models, we have updates to ourthe world at large. We take our commitment toopen trust and safety project including a Meta Llama

building responsible AI seriously, cognizant of theGuard 2 model that supports a broader taxonomy forpotential privacy and content-related risks, as wellinput/output prompt filtering.

as societal impacts.

AI at Meta

April 20242

How to use this guideThis guide is a resource for developers that outlines

The recommendations included in this guide reflect

common approaches to building responsibly at eachcurrent research on responsible generative AI. We

level of an LLM-powered product. It covers best

expect these to evolve as the field advances andpractices and considerations that developers should

access to foundation models grows, inviting further

evaluate in the context of their specific use case andinnovation on AI safety. Decisions to implement

market. It also highlights some mitigation strategies

best practices should be evaluated based on theand resources available to developers to address risks

jurisdiction where your products will be deployed andat various points in the system. These best practices

should follow your company’s internal legal and risk

should be considered holistically because strategies

management processes.

adopted at one level can impact the entire system.

AI at Meta

April 2024

3

Overview of responsible
AI & system design

Responsible AI considerations
Helping to ensure that generative AI technology

technology that have already surfaced online, such as

does not produce content that could cause harm is of

the creation or proliferation of illegal content, content

paramount importance. Generative AI is developing

which may be objectionable or hateful, or content

rapidly and is being driven by research, openthat may result in the provision of unqualified advice.

collaboration, and product releases that are putting

These instances may increase as generative AI tools

this technology in the hands of people globally.

become more accessible.

Growth at this scale presents novel challenges forthe responsible deployment of AI, yet many of theprinciples of responsibility remain the same as for any
other AI technology. These considerations, core to
Meta’s approach to responsible AI, include fairness
and inclusion, robustness and safety, privacy andsecurity, and transparency and control, as well asmechanisms for governance and accountability. LLMs
are one of many AI tools, and their risks should be
evaluated through these lenses according to how they
will be used.
Foundation models and generative AI systems
represent advancements in power and accuracy
compared to predecessor technologies. The increasein the performance, utility, and flexibility of thesemodels will likely lead to their ubiquity, as the value
they bring to some pre-existing use cases may
outweigh operational costs of deploying the systems.
The ability to generate completely new content also
opens up new use cases that must be evaluatedfor the types of risks they may present. There arepotential risks related to the misuse of thisFor our own, on-platform generative AI offerings,
Meta is implementing safety measures to addresscontext-specific risks. These mitigations are layered
across different intervention points beyond thosethat can be assessed and mitigated in the foundation
model. With our release of Llama 3 paired with Llama
Guard 2, we are beginning to extend this vision of alayered approach to safety to our open models
as well.
As discussed in our research paper on Llama 2,
some mitigations applied at early stages in thedevelopment process can be detrimental to theperformance and safety of the model, and somerisks may be better addressed at later points in the
product development cycle. Our vision for layered
model safety helps to empower developers tomake decisions about balancing these trade-offs.
Developers of generative AI-powered features thatleverage open source models will have more power toensure that their products are safe and benefit end
users, while taking a holistic view of responsible AI
across the entire product development cycle.

AI at Meta

April 2024

4

Mitigation points for LLMpowered products
A foundation model is a general purpose AI
technology whereas an LLM-powered product has
a defined use case and performs specific tasks
to enable an intended use or capability through aModel-level safety: Model-level safety concerns thedata preparation and processing best practices andhuman feedback or alignment practices for safety at
the foundation and fine-tuned model level.

user interface, sometimes embedded in products.
An LLM-powered system encompasses both the

System-level safety: System-level safety is the venue

foundation model and accompanying input-output

for the most context-specific safety mitigations

safeguards, and a number of product-specificdependent on user interactions. Developers looking

layers. At various points in the product development

to craft safety mitigations specifically for their use

lifecycle, developers make decisions that shape thecase with the goal of offering their users the best

objectives and functionality of the feature, which can

product experience should explore these options.

introduce potential risks. These decision points also
provide opportunities to mitigate potential risks. It
is critical that developers examine each layer of the
product to determine which potential risks may arise

You can learn more about our layered approach tosafety by visiting our resources for Meta Llama open
trust and safety.

based on the product objectives and design, andThe following section presents responsible AI

implement mitigation strategies accordingly.

considerations for the different stages of LLM
product development. At each of these levels, wehighlight best practices for mitigating potential risks.

AI at Meta

April 20245

Development of thefoundation model

Meta Llama 3, like Llama 2, is licensed for commercial

The training datasets for Llama are sourced fromuse. This release of Llama 3 features both 8B and 70B

a broad set of diverse, publicly available online

pretrained and instruct fine-tuned versions to help

data. This training corpus is mostly English, which

support a broad range of application environments.

is consistent with the current, intended use ofThis next generation of Llama demonstrates state-

the model. For each dataset used in training, weof-the-art performance on a wide range of industry

followed Meta’s standard privacy review processes.

benchmarks and offers new capabilities, including

And for our pretraining data we made an effort

improved reasoning. With the developer in mind, andto remove data from certain sources known toin support of our longstanding open approach, we

contain a high volume of personal information about

wanted to put Llama 3 in the hands of the community

private individuals. After pretraining, the model can

as soon as possible to enable early development andreproduce everything from simple grammatical rules

kickstart this next wave of innovation.

to complex nuances like context, sentiment, andIn addition to performing a variety of pretraining
data-level investigations to help understand thepotential capabilities and limitations of our models,
we applied considerable safety mitigations to thefine-tuned versions of the model through supervised

figurative language. However, the model does notgain knowledge or generate beliefs about the worldin the way humans do. It only learns to predict thenext word in a sentence based on the patterns in its
training data.

fine-tuning, reinforcement learning from humanIf you’re going to use the pretrained model, we

feedback (RLHF), and iterative red teaming (theserecommend tuning it by using the techniques

steps are covered further in the section - Fine-tune

described in the next section to reduce the likelihoodfor product).

that the model will generate outputs that are inMore information on Llama 3 model architecture andparameters and pretrained evaluations are containedin the model card. The model card also provides
information about the capabilities and limitations of
the models.

conflict with your intended use case and tasks. If
you have terms of service or other relevant policies
that apply to how individuals may interact with your
LLM, you may wish to fine-tune your model to bealigned with those policies. It may also be necessary
to establish new terms of service and policies specificDuring pretraining, a model builds its understanding

to LLMs, or notify users about how their data orof the statistical patterns across the sample offeedback provided will be used in fine-tuning. We also

human language contained in its training data.

recommend using Llama Guard 2 for enhanced safety
performance.

AI at Meta

April 2024

6

Responsible LLM productdevelopment stages

1

Developers will identify a specific product use casefor the released model, and are responsible for

Determine use caseassessing risks associated with that use case andAn important decision in the development process

applying best practices to ensure safety. This sectionis which use case(s) to focus on. Most developers

outlines the considerations and mitigation strategies

using this guide already have a use case in mind,

available at each stage of product development

such as customer support, AI assistants, internaland deployment.

productivity tools, entertaining end-user experiences,or research applications. If you’re a developer who

At a high level these stages include:

is not certain of a particular use case for which you

would want to use the model, consider focusing on

1.

Determine use case2.

Model-level alignment

3.

System-level alignment

assessment process can help identify potential

4.

Build transparency and reporting
mechanisms in user interactions

how your product’s end users and others could be

use cases that improve the lives of people and society,taking into consideration different ethical principles
and values. Developing or adopting an internal risk

risks for a specific use case and should focus onaffected. This understanding is critical for evaluating
in-context safety for your product deployment, andcan take forms such as surveys and interviews ofpotential users or market analysis of similar productapplications.
If you are new to considerations of values in thedevelopment and deployment of AI, refer to theprinciples and guidance on risk management releasedby academic and expert institutions, such as:• OECD’s AI Principles•

NIST’s Trustworthy and Responsible AI
Resource Center

AI at Meta

April 2024

7

Define content policies
Based on the intended use and audience for yourproduct, a content policy will define what content
is allowable and may outline safety limitations on

applying content policies falsely (i.e., false positives
and false negatives.) These errors will necessarilymean that a model will either be more aligned andless helpful or less aligned and more helpful.

producing illegal, violent, or harmful content. These

To illustrate: Consider a content policy against

limits should be evaluated in light of the productassistance with scams. If a user submits a prompt

domain, as specific sectors and regions may havefor “How does a ponzi scheme operate?” the model

different laws or standards. Additionally, the needs

can either refuse to substantively answer (arguablyof specific user communities should be considered as

the most aligned, least helpful option) or provide ayou design content policies, such as the development

complete, detailed answer (arguably the most helpful,of age-appropriate product experiences. Having

least aligned option). Consider the same evaluation,these policies in place will dictate the data needed,

but with the prompt “How to protect yourself fromannotation requirements, and goals for safety fine-

identity theft.”tuning, including the types of mitigation steps thatAs the model’s rate of identifying and stopping

will be implemented. Defining these policies will be

unaligned content grows, its likelihood of falsely

used for labeling data in later stages when using

stopping aligned content–and thereby reducing its

RLHF and in additional product layers, such as making

overall helpfulness–grows in tandem. In other words,

enforcement decisions for user inputs and model

you’ll need to look elsewhere to learn about stopping

outputs.

identity theft. Turning down the dial–so that more

If you are new to considerations of content policies,

unaligned content gets through–will likely have therefer to commonly used policies in the industry suchknock-on effect of increasing the likelihood that theas the taxonomy proposed by MLCommons.

model generates helpful content. You’ll learn aboutprotecting your identity from thieves.

Understand alignment-helpfulness
trade-offs
While overall model safety should keep improving
as models advance, some trade-off between model
helpfulness and model alignment is likely unavoidable.
That’s because any prediction–Is this content aligned?
Is this content unaligned?–carries at least some risk of

Avoiding alignment-helpfulness trade-offs isprobably impossible. But developers should exercise
discretion about how to weigh the benefits ofalignment and helpfulness for their specific use caseand audience. We look forward to exploring more
ways to give developers greater control over thisimportant aspect of model building.

AI at Meta

April 202482Model-level alignment
Product-specific fine-tuning enables developers toleverage pretrained models or models with some finetuning for a specific task requiring only limited data
and resources. Even with initial fine-tuning performedby Meta, developers can further train the model withdomain-specific datasets to improve quality on theirdefined use case. Fine-tuning adapts the model todomain- or application-specific requirements andintroduces additional layers of safety mitigations.
Examples of fine-tuning for a pretrained LLM include:• Text summarization: By using a pretrained language
model, the model can be fine-tuned on a datasetthat includes pairs of long-form documents andcorresponding summaries. This fine-tuned model
can then generate concise summaries for new
documents.
•

Question answering: Fine-tuning a language
model on a Q&A dataset such as SQuAD (Stanford

These examples showcase
how fine-tuning an LLM
can be used to specialize
the model’s capabilities for
specific use cases, improving
its performance and making
it more suitable for specificapplications. The choice ofthe foundation model and thetask-specific dataset plays acrucial role in achieving thedesired results.

Question Answering Dataset) allows the model tolearn how to answer questions based on a given
context paragraph. The fine-tuned model can thenbe used to answer questions on various topics.
•

Sentiment analysis: A model can be fine-tuned
on a dataset of labeled text reviews (positiveor negative sentiment) to recognize sentiment andperform analysis to understand user satisfaction.
By training the model on this task-specific dataset,it can learn to predict sentiment in text accurately.

AI at Meta

April 2024

9

The responsible fine-tuning flow
Here are the general steps needed to responsibly finetune an LLM for alignment, guided at a highlevel by Meta’s Responsible AI framework:
1. Prepare data
2. Train the model
3. Evaluate and improve performance

Step 1: Prepare data
Developing downstream applications of LLMs begins
with taking steps to consider the potential limitations,privacy implications, and representativeness ofdata for a specific use case. Begin by preparing andpreprocessing a clean dataset that is representativeof the target domain. This involves tokenizing the text,
handling special characters, removing unnecessary
information, and splitting the dataset into training,validation, and testing sets. This step may also involve
ensuring that data are representative of the end users
in the deployment context, for instance, by ensuring
there are enough examples from relevant languages if
you plan to deploy your product in a
non-English speaking market. Representativenessof data is dependent on the use case and should beassessed accordingly.
When fine-tuning for a specific use case it can bebeneficial to examine training data for biases, suchas gender, racial, linguistic, cultural or other biases.

AI at Meta

April 202410

THE RESPONSIBLE FINE-TUNING FLOW

Understanding these patterns is important but it may
not always be optimal to filter out all problematic
content in training data due to the unintended
consequences this filtering may have on subsequent
performance and safety mitigations, such as prompt
engineering. Instead of removing data, focusing on
the representativeness of the data can help preventa fine-tuned model from perpetuating biases in its
generated outputs; what is considered representative
will depend on the specific context in which a productis deployed. Developers should also pay attention
to how human feedback and annotation of data may
further polarize a fine-tuned model with respect
to subjective opinions, and take steps to prevent
injecting bias in annotation guidelines and to
mitigate the effect of annotators’ bias. Resources

Step 2: Train the model
Fine-tuning involves training the model for a limited
number of iterations. Once a pretrained model
is loaded in the environment for fine-tuning, thetraining process involves setting up hyperparameterslike epochs, batch size, and learning rate. The data
are passed through the model, loss is computed, andweights are updated through backpropagation. The
training progress is monitored using a validation set,and hyperparameters are adjusted as necessary.
Fine-tuning an LLM for safety can involve a numberof techniques, many of which the research paper on
Llama 2 describes in greater depth. These techniques
can include:•

tuning using data annotated across helpfulness

on this topic include:•and safety.

Don’t Blame the Annotator: Bias Already Starts in
the Annotation Instructions• Annotators with Attitudes: How Annotator Beliefs
And Identities Bias Toxic Language Detection

Supervised Fine-Tuning (SFT): Supervised fine-•Reinforcement Learning from Human Feedback(RLHF) or AI Feedback (RLAIF): Training safety
and helpfulness reward models to support

There are several other risks to consider, such as

RLHF techniques iteratively improves models

overfitting, privacy, and security. To mitigate theseand makes them more robust to jailbreaking

risks, carefully design the fine-tuning process bytechniques.

curating a high-quality dataset that is representative• Targeted Safety Context Distillation: Context

of your use case, conduct rigorous evaluations, anddistillation for safety helps the model associate

test your fine-tuned model’s potential use via red

adversarial prompts with safe responses byteaming (covered in step four - Evaluate andprefixing a safe preprompt such as “You are a

improve performance).

safe and responsible assistant” to the adversarial
prompt, followed by fine-tuning on new outputs.

AI at Meta

April 202411

THE RESPONSIBLE FINE-TUNING FLOW

Reinforcement Learning from Humanperformance and safety, and iterating until satisfied

Feedback (RLHF)

with the model’s performance using holdout test

To align the output of LLMs with user expectations

datasets.

and values, one approach that developers should

There are many complementary types of evaluations

consider is implementing Reinforcement Learningthat are useful for measuring risks in models,from Human Feedback (RLHF) mechanisms. This

including automatic benchmarks, manual annotations

involves collecting ranking data from trainedby human raters, and evaluations using an LLM

annotators or users (given a model input and several

itself as a rater. The Holistic Evaluation of Language

generated outputs, ranking them from best to worst

Models discusses some of the most commonly usedaccording to policies), training a reward or helpfulness

automatic benchmarks. As the industry matures, we

model to act as a proxy of human feedback, andare excited for evaluation platforms to emerge tothen optimizing the LLM to maximize the reward/

help drive safety standardization, such as throughhelpfulness model score with reinforcement learning.

the MLCommons AI Safety working group. Evaluation
strategies and processes to improve performance canReinforcement Learning from AI
Feedback (RLAIF)

include:• Automatic evaluation leverages automatic

Reward models can also be improved and tailored tobenchmarks and classifiers to judge the output

specific policies by using Reinforcement Learningwith respect to a specific category of risk.

from AI Feedback (RLAIF). The fine-tuned LLM itself
can be used to create synthetic ranking data for•or subject matter experts to judge the model’s

reward model training. Given a model input, response
pairs and relevant guidelines, the LLM predicts
which response would best follow the guidelines.
The synthetic reward modeling data are then used toaugment the reward model’s training data.

Manual evaluation leverages human annotators
output.

•

Red teaming is a systematic effort to identify
model vulnerabilities or emergent risks bycrafting prompts that may elicit undesirable
behavior or outputs. This type of manipulationof the model can be used to test safeguards andStep 3: Evaluate and improve performance

attempts to “jailbreak” the model.

The final stage is to evaluate the fine-tuned model ona test set to measure its performance on the specifictask and against safety benchmarks, according to
the use case. This includes analyzing the model’s
strengths and weaknesses based on evaluation
results, gathering more data to further enhance

AI at Meta

April 2024

12

Red teaming best practices
Red teams should adopt systematic approaches
to testing and measurement, while estimating
real-world behaviors and threat vectors to theextent possible.

•

Regular testing: The model should undergo
regular testing to determine whether or not
mitigations against attacks are effective.
This requires some form of automatedevaluation, either with human labeling, which
can be expensive, or with classifiers trained•

Diversity: Red teams should include a diverse

to recognize responses that fall under theset of people from a range of professionalrisk categories.

backgrounds that are representative of a broadgroup of potential users and demographics. Red
teams can be composed of internal employees,
experts, or community members.
•

Subject matter expertise: Subject matter experts
should judge model responses based on theirfamiliarity with the identified risk categories andlabel responses that fall under each category.

AI at Meta

April 2024

13

Privacy adversarial attacks
Additional privacy protections should be consideredwhen releasing the product, to test whether bad
actors may be able to improperly extract information.
A privacy adversarial attack is a method whereattackers can exfiltrate data from a model. For
example, common adversarial attacks may include
membership inference attacks on a model to predictwhether or not a particular sample was in the training
data, or model inversion attacks to reconstructrepresentative views of a subset of examples.
Prompt injection attacks are attempts to circumventcontent restrictions to produce particular outputs.

3

System-level alignment
Without proper safeguards at the input and output
levels, it is hard to ensure that the model will respondproperly to adversarial inputs and will be protectedfrom efforts to circumvent content policies andsafeguard measures (“jailbreaking”). Mitigations at
the output level can also act as a safeguard against
generating high-risk or policy-violating content.
Enforcement of content policies can be managed
through automated systems and manual analysis
of samples and reports. Automated systems may
include machine learning and rule-based classifiers
for filtering prompt inputs or system outputs. Usage

A red team privacy adversarial attack conducted by aor consequence policies may be defined for whencompany may be able to demonstrate the feasibility

users repeatedly violate those policies.

of such attacks. In scenarios where companies
fine-tune models using personal data (pursuant toapplicable privacy laws), they should consider testing
the outputs to see if the model memorized particular
data. This approach may be especially useful for
testing models that are intended to be deployed as
AI assistants or agents.

Enforcement of content
policies can be managed
through automated systems
and manual analysis ofsamples and reports.
Automated systems may include machine learningand rule-based classifiers for filtering prompt inputs
or system outputs. Usage or consequence policies
may be defined for when users repeatedly violate
those policies.

AI at Meta

April 2024

14

Mitigating risks at the input level
The input refers to the information provided by
the user and passed to the system. The developer
does not control what the user inputs. Without
implementation of input filters and safeguards, evenadvanced models can potentially be manipulated togenerate harmful or misleading outputs or violate
content policies. Although safeguards to protect
privacy and prevent potential harm can be developedby tuning the model, it should be expected that evenafter rigorous design and testing, those safeguards
will not have perfect performance and may be
subverted. Additional safeguards include direct
filtering and engineering of the inputs. For these tobe effective, model inputs must be well-formatted.
These approaches include:•

Prompt filters: Even when inputs may not
violate content policies, the model may produce
problematic engagements or outputs. In thesecases, it may be appropriate to filter, block, andhard code responses for some inputs until themodel can respond in the intended way. Thistactic may come with tradeoffs to the user’s
experience and agency in engaging with thesystem. Thus, the safety benefits of such
restrictions or modifications should be weighed•

Prompt engineering: Direct modifications of
the user inputs are an option for guiding themodel behavior and encouraging responsible
outputs, by including contextual information orconstraints in the prompts to establish backgroundknowledge and guidelines while generating theoutput. Modifications may be done in a variety
of ways, such as with automated identificationand categorization, assistance of the LLM itself,
or rules engines. These can help improve theuser experience by creating more diversity andexpressiveness from the model. For example,
prompt engineering can be leveraged to direct themodel to include more diverse references or apply
a certain tone or point of view. Prompt engineeringrules may be hard coded or probabilistic.

Alongside prompts, it
might be beneficial toprovide instructive sample
inputs and outputs that
illustrate the desired
responsible behavior.

against those costs, until more robust solutions
are developed.

AI at Meta

April 2024

15

Mitigating risks at the output level

unreasonably restrict the usage of your model.
Words often have context-dependent meanings,

Based on the downstream use case, you can apply

and terms that could be sexually suggestive, forseveral approaches for detecting and filtering theexample, may also be used in medical contexts.

generated output of models for problematic or policy-

Content policies will help articulate the specifics

violating content. Here are some considerations andbetween permitted and prohibited topics to users.

best practices for filtering outputs. Any output filter
mitigation should include all languages that are usedin the region where your product is available.
•

Blocklists: One of the easiest ways to prevent thegeneration of high-risk content is to compile alist of all the phrases that your model should not,under any circumstances, be permitted to include
in a response. Many words are easily identifiable
as problematic; slurs, for example, are typicallyoffensive no matter their context. While blocklists•

Classifiers: The more effective, but also moredifficult, approach is to develop classifiers that
detect and filter outputs based on the meaning
conveyed by the words chosen. Classifiers,
when properly trained on known examples of aparticular sentiment or type of semantic content,
can become highly effective at identifying novel
instances in which that sentiment or meaning
is expressed.

are attractive for their simplicity, they may

AI at Meta

April 2024

16

Evaluate effectiveness
While prompt filtering and engineering are criticalsafety mitigations, it’s important to monitor
effectiveness and avoid unintended consequences.
Some best practices include:• Test for unintended outcomes. Takecaution that prompt engineering doesn’t
inadvertently create other issues. Test
end-to-end performance after any prompt
engineering to ensure desired behavior.
•

Evaluate effectiveness of safeguards. Many

4

Build transparency and reporting
mechanisms in user interactions
Releasing an LLM-powered feature for users tointeract with can reveal new use cases as well as
new concerns. User interactions can provide criticalfeedback, which can be used for reinforcement
learning (discussed in a previous section). This isalso an opportunity to provide appropriate notice,transparency, and control to users, which can lead togreater satisfaction and trust in the feature.

publicly available datasets offer collections

Feedback & reporting mechanismsof prompts that are designed to benchmark

Facilitating user interaction with appropriate

against specific concerns when used as inputs.

feedback or reporting mechanisms is key to ensuring

After model responses are collected, they canquality output. Feedback mechanisms can be as

be evaluated by using standardized metrics.

simple as positive or negative (thumbs up or thumbs• Adjust for different languages. Prompt
filtering and engineering mitigations should
include all languages that are used in theregion where your product is available; theeffectiveness of these mitigations may be
dependent on linguistic and community-level
nuances. Llama was trained primarily on data
in English, in accordance with its intended
use, so it is critical to carefully evaluate any
mitigations in other languages.

down), and tailoring feedback to the types of issues
that may be foreseeable based on a company’s use
case (for example, AI assistants) can enhance thequality of feedback. This feedback can be used bydevelopers to improve the model in more targeted
ways. Providing an option for freeform feedback
within a reporting mechanism can also reveal new orunanticipated concerns raised by users. Furthermore,users can identify and highlight errors, unsafe
behaviors, or suboptimal actions that the model
might not recognize on its own. Developers canfurther train the model with this feedback to improve
performance and avoid repeating mistakes. ProductAI at Meta

April 202417

developers should review feedback by monitoring thecritical factors in ascertaining when and how

rate that users report model outputs and by manually

to be transparent. Work with your appropriate

reviewing those reports and selected samples ofadvisors to determine the types of transparencymodel outputs.

that should be provided to users, including
whether users should be informed that their

Transparency & control best practices

responses may be used to fine-tune a model.

To ensure high-quality feedback and provide end

Developers should also consider the use ofusers with notice and choice about their interactions

system cards to provide insight into their AI

with your AI assets, developers should consider thesystem’s underlying architecture and explain how

following practices for user interactions:a particular AI experience is produced. Further
best practices are outlined in the Partnership on• Transparency: Developers should consider ways

AI’s Responsible Practices for Synthetic Media.

to provide transparency to end users regarding
potential risks and limitations of the system•

Control mechanisms: Additional controls could

prior to or at the time of user interaction. For

include giving users the option to customize theinstance, notice to users that they are interacting

outputs generated by an LLM. For example, awith an AI-powered chatbot may increasinglyuser could select or reject outputs from a list of

be required in certain markets, and is a best

multiple options. Offering editing capabilities

practice to address concerns that may be related

can also enhance a user’s sense of agency

to false or incorrect information. Developers

over outputs, and developers should consider

should neither claim nor imply that an AI agent is

education flows that can set a user up forhuman, especially when building and deploying

success, such as offering prompt suggestions oranthropomorphized interfaces. Context, intent,

explanations of how to improve an output.

sensitivity, and likelihood to deceive are additional

AI at Meta

April 2024

18

Resources for developers

There is a value chain emerging to support the
responsible training and use of LLMs, which we
believe will be advanced through more open
releases and sharing of best practices, tools, andFilters and classifiers:•• Content-filtering systems from Azure, supportinga range of languages: learn.microsoft.com/

benchmarking. A growing number of researchers,

en-us/azure/cognitive-services/content-safety/

platforms, companies, and developer communities

overview

are contributing to this ecosystem. We expect more
tools for the responsible development of LLM to•

Filter lists for generation of problematic words:
github.com/LDNOOBW/naughty-words-js

become available over time and are committed tofostering more open exchange of safety research andMeta Llama Guard and other solutions•

Recipes for safety in open-domain Chatbots,
including a sensitive topics classifier: parl.ai/

tools to support developers.

projects/safety_recipes/

It is critical to remain awareof the latest versions ofPlatforms for tools and evaluations:models and use the most•

MLCommons AI Safety (v0.5): mlcommons.
org/2024/04/mlc-aisafety-v0-5-poc/current version to get the•Meta Llama Cybersecurity evaluations

best results.

•

Benchmarking of LLMs by Stanford’s Center for
Research on Foundation Models, HELM: crfm.
stanford.edu/helm/latest/

Our partnership to make Llama available on the Azure
Model Catalog will enable developers using Microsoft•

EleutherAI/lm-evaluation-harness

Azure to leverage their cloud-native tools for content
filtering and safety features. Below, we provide a

EleutherAI LLM Evaluation Harness: github.com/•

Hugging Face Hub which hosts open source

few notable hubs and implementation resources formodels, datasets, and is a space for developers

developers, but this list is not exhaustive. Microsoft

to share safeguards and access benchmarking

also offers a repository of Responsible AI Resources.

information: huggingface.co/docs/hub/index

AI at Meta

April 2024

19

Reporting resources•

facebook.com/whitehat/info

If you have any information about issues, violations,or problems, please help keep our communities safeby using our reporting resources.
•

Reporting issues with the model: github.com/

Reporting bugs and security concerns:•

Reporting violations of the Acceptable
Use Policy or unlicensed uses of Llama:
LlamaUseReport@meta.com

facebookresearch/llama•

Reporting risky content generated by
the model: developers.facebook.com/
llama_output_feedback

AI at Meta

April 2024

20

Combining the componentsof responsible generative AI

Each stage of model development presents

data-collection stage to user feedback, be sureopportunities to enhance the safety of your AI

to keep your overall goal in mind.

feature. However, it’s crucial to acknowledge the•Standardizing processes for learning frominterconnectedness of these stages and how the

feedback/errors. Embracing an iterative model-

decisions made at each stage can impact others.

development mindset is crucial. Establish a well-

Building a responsible AI ecosystem requires ongoing

defined process for incorporating new learnings

efforts to refine each component and ensure they

into subsequent model training. This process

work together effectively.

should include consistent feedback analysis,

Here are some key considerations for implementing
these components in unison:•

Holistic optimization. Although each component
has a specific role and optimization goal,
components are not isolated entities. Overoptimization of one component without
considering its interaction with others can leadto suboptimal outcomes. For instance, overfiltering training data for safety might makelater fine-tuning less effective, as the model
may not recognize and handle unsafe content•

prioritization of identified issues, and systematic
application of learnings in the next iteration ofmodel training.
The field of generative AI is complex, ever-evolving,
and full of potential, but it’s not without risks. The
key to unlocking its benefits while mitigating thedownsides is responsible AI practice. This practicestarts with understanding the complexities of thetechnology, the potential impacts on users andsociety, and the importance of continuously striving
for improvement.

appropriately. This is why different layers of

By embracing the principles of transparency,

safety mitigations throughout the development

accountability and user empowerment, as welllifecycle are critical for creating high-performing,as having a commitment to ongoing learning andresponsible products.

improvement, you can ensure that your AI feature

Alignment of objectives at each stage ofdevelopment. To yield a product that is optimized
for your target use cases, it’s essential to havea consistent set of goals and outcomes thatis not only innovative and useful but also responsible
and respectful. We hope this guide serves as avaluable tool in your journey toward responsible
AI practice.

guide each stage of the process. From the

AI at Meta

April 2024

21

ADDENDUM

Introducing Code Llama

Code Llama is a set of large language models forcode with known insecure patterns or complying

code based on Llama 2 providing strong codewith a cyber attacker’s request. Measuring thegeneration and infilling capabilities, support formodel’s response to malicious requests allowed

large input contexts, and zero-shot instruction

us to implement mitigations which make Codefollowing ability for programming tasks, as well as

Llama 70B safer than other available models, whilestate-of-the-art base models for fine-tuning. We

remaining helpful. For detailed information on model

provide multiple flavors to cover a wide range oftraining, architecture and parameters, evaluations,applications: foundation code models (Code Llama),

responsible AI and safety refer to our research paper

Python specializations (Code Llama - Python), andand Responsible Use Guide.

instruction-following models (Code Llama - Instruct)with 7B, 13B, 34B and 70B parameters each. All
models are trained on sequences of 16k tokens
and show improvements on inputs with up to 100k
tokens. The 7B and 13B Code Llama and CodeLlama - Instruct variants support infilling based onsurrounding content. Code Llama was developedby training Llama 2 on publicly available code andnatural language datasets related to code.
Building AI models responsibly is important tous, and we undertook a variety of safety measures

This addendum to the guideoutlines additional, codingspecific best practices thatdevelopers should consider
in responsible developmentof downstream codingrelated features.

before releasing Code Llama, including many ofthe measures used for Llama 2. Before releasing
the 7B, 13B, and 34B variants in August 2023, we
asked cybersecurity and malware development
experts to evaluate the Code Llama model’s capacity
for enabling malware development by otherwise
unskilled adversaries. We subsequently expanded
our evaluation suite to include Meta’s CyberSecEval,
which evaluates an LLM’s capacity for producing

Code Llama potential use cases
Code Llama has two broad use case categories:
1.

Foundation model use case: Train on more data
to create variants of Code Llama, e.g, add otherprogramming languages (C++, Java), increasecontext length, reduce latency by quantizationof model, etc.

AI at Meta

April 2024

22

ADDENDUM

2. Instruction model use case: Add more instructioncode-specific best practices when building on top ofdata to improve the model’s ability to follow

Code Llama in line with their specific use case.

instructions, extend capability to understandDefine content policies for use casenon-English instructions, create standalone
code bots and integrate into existing 3rd party• A content policy defines what content is allowable
based on the intended use and deployment

products, etc.

context. This may also outline limitations on

Both the foundation and instruction Code Llama

producing potentially problematic content. Inmodels are not designed to be used as a large

the code domain, models should avoid producing

language model for general purpose - for suchmalware, virus, or malicious code. Developers

scenarios refer to Llama 2.

should consider how bad actors prompt the1

model to produce these results.
• These policies will dictate the data needed,annotation requirement, and goals of safety
fine-tuning. They may also be applied in inputand output-level safeguards as additionalsafety mechanisms.
Evaluations & benchmarks•

Models should be evaluated against theirintended use and end user requirements.

Foundation model use caseSpecifically, code models should be evaluatedThis model could be used for further researchagainst code-specific benchmarks. As a resource,

exploration on specialized foundation large

you can find various benchmarks on Papers withlanguage models for programming. When

Code: Code Generation Benchmarks.

fine-tuning Code Llama, we refer users to the

Responsible Use Guide for Llama 2, which provides•

safety of coding models with the CyberSecEval

essential guidance on responsible development(GitHub) which was released as part of our openof downstream models, including on (i) defining
content policies and mitigations; (ii) preparing
data; (iii) fine-tuning the model; (iv) evaluating andimproving performance; (v) addressing input- andoutput-level risks; and (vi) building transparency
and reporting mechanisms in user interactions.

We recommend evaluating the cybersecurity

trust and safety tools and evaluations project.
•

Non code-specific safety evaluations are also
recommended, for example, code models can beevaluated on benchmarks such as TruthfulQA,
ToxiGen and BOLD.

Additionally, developers should consider

AI at Meta

April 2024

23

ADDENDUM

Red teaming & fine-tuning considerations• The data should be representative of the

•

•

•

•

If the model’s output will be used in production
systems, developers should ensure the code thatend users’ requirements. For example, if thethe model is trained on is free of relevant security

model is meant for Javascript generation,

vulnerabilities. Developers and end-users thatthe dataset chosen to fine-tune with should

use the model as an assistant for software

be Javascript-focused. Developers should also

development should continue to follow security

consider examining and placing restrictions

best practices.

on any potentially malicious or nefarious code

System-level safeguards

in the data.

• As for other LLM use cases, we recommend

Developers should ensure the security andadding appropriate system-level safeguards inrobustness qualities of the training code dataset

addition to the model-level built-in alignment.

matches the security requirements of the output• As part of our open trust and safety tools, weand the systems where the output code will be

released Code Shield, an insecure code detector

integrated based on a specific use case.

that can be used at inference to prevent bad

Developers should perform safety studies oncoding practices. Visit Code Shield Github forcode-specific areas such as intentional malware

more information on how to integrate it into

generation and the unintentional introduction

your application.

of vulnerable code. Working with red-teaming

When using Code Llama in particular, it is important

domain experts can help developers evaluate

to keep in mind that Code Llama is specialized forthe model’s capacity to lower the bar for writingcode-related tasks and may not be appropriate as a

malicious code when the prompt intent is clear

foundation model for other task families, e.g, generaland the output goes beyond resources alreadylanguage model. We note that for downstream tasks

publicly available on the Internet.

where the Python programming language is more

Developers and end-users that use the model as

relevant, it may be more appropriate to use our Codean assistant for software development should

Llama - Python model variant. Code Llama and Codebe aware of the model’s overall language safety.

Llama - Python are not trained with instruction

Performing safety studies and comparing results

data hence are not designed to follow instruction in

to representative benchmarks can identify

natural language. Any use of these models to performparticular categories of content risk. To mitigate

general natural language tasks is not recommended

those risks, collect relevant fine-tuning data thatto avoid potential misuse of the models.

is not within the test set, and fine-tune the modelby controlling for higher measured safety while
maintaining helpfulness.

AI at Meta

April 2024

24

2
ADDENDUM

Instruction model use case

Reporting resources for developers

This model could be used for further appliedIf you have any information about issues,

research and testing of specialized large language

violations, or problems, please help keep ourmodels for programming. Code Llama - Instructcommunities safe by using our reporting resources.

has the ability to understand instructions in•natural language. When using Code Llama for code

generation tasks, we recommend developers use
our Code Llama - Instruct variants, which havebeen fine-tuned to generate helpful and safe
answers to users. Consult the full Responsible
Use Guide for best practices with regards toReporting issues with the model via our
GitHub repo•

Reporting risky content generated by themodel via our Developer portal•

Reporting bugs and security concerns via our
Bug Bounty

generally addressing input- and output-levelrisks and building transparency and reporting
mechanisms in user interactions, as relevant toa specific use case.
For both use cases, users must abide by our
Acceptable Use Policy.

AI at Meta

April 202425