- Evaluations with more interactions. In this work, we mainly evaluate different perspectives of trustworthiness for GPT models on static datasets, such as 1-2 rounds of conversations. Given the dynamic nature of large language models, it would be important to evaluate the LLMs with interactive conversations and assess whether these vulnerabilities of the models would become more severe or not.
- Misleading context beyond jailbreaking system prompts and demonstrations in in-context learning. In order to evaluate potentially the worst-case performance of GPT models, we design different jailbreaking system prompts and diverse misleading (adversarial) demonstrations to evaluate the model vulnerabilities. In addition to such misleading prompts, one can also inject misleading information during the conversation (e.g., "honeypot conversation") to mislead the model performance. It would be interesting to see how vulnerable the model is under different types of misleading contexts.
- Evaluation considering coordinated adversaries. In this work, we mainly consider one type of misleading or adversarial cases for each test scenario. However, in practice, it is possible that different adversaries would coordinate to fool the model given, say, strong economic incentives. Thus, it is important to explore how vulnerable the model could be under coordinated and stealthy adversarial behaviors.
- Domain-specific trustworthiness evaluations. Our evaluations in this work focus on the general vulnerabilities of GPT models, and we use standard tasks such as sentiment classification and NLI tasks as illustrations. In practice, GPT models have already been widely adopted in different domains, such as laws and education, so it is important to evaluate the model vulnerabilities based on their specific usage in different domains.
- Verification for the trustworthiness of GPT models. Empirical evaluations of LLMs are important but lack of guarantees, especially in safety-critical domains such rigorous guarantees would be critical. In addition, the discrete nature of GPT models makes it challenging to provide rigorous verification for such models. It would be important to divide the challenging problem into solvable sub-problems, such as providing guarantees and verification for the performance of GPT models potentially based on their concrete functionalities [199, 187], providing verification based on the model abstractions, or mapping the discrete space to their corresponding continuous space such as the embedding space with semantic preservation to perform verification.
- Safeguarding GPT models with additional knowledge and reasoning analysis. As purely data-driven models, GPT models would suffer from the imperfection of the training data and lack of reasoning capabilities in various tasks. Thus, it would be important to equip domain knowledge and logical reasoning capabilities for language models and safeguard their outputs to make sure they satisfy basic domain knowledge or logic to ensure the trustworthiness of the model outputs, such as retrieval-augmented pretraining [179, 178].
- Safeguarding GPT models based on game-theoretic analysis. Our designed system prompts based on "role-playing" shows that models can be easily fooled based on role-changing and manipulation. This indicates that during the conversation of GPT models, it is possible to design diverse roles to ensure the consistency of the model's answers, and therefore at least avoid the models being self-conflict. It is also possible to design different roles for the models to make sure it understands the context better to provide more informative and trustworthy answers.
- Auditing GPT models based on given instructions and contexts. Our evaluations here are based on general purpose, and sometimes users would have specific safety or trustworthiness requirements which are important to enforce the models to follow. Thus, it is important to map the user requirements and instructions to certain logical spaces or design specific contexts and verify whether the models' outputs satisfy these requirements in order to audit the model more efficiently and effectively.