- Obsecure pretraining data. As the pretraining data of GPT-3.5 and GPT-4 is not publicly available, it is challenging to reason why sometimes the models fail under certain conditions or how to fix the issues. For example, it is challenging to evaluate the out-of-distribution robustness, as it requires constructing scenarios that the model has not encountered during training, which is unknown. Our evaluation is thus limited by our hypothesis (e.g., OOD distributions) to anticipate these scenarios.
- Subjectivity. Trustworthiness perspectives such as toxicity, stereotype bias, machine ethics, and fairness involve subjectivity and should be human-centric in their definitions and evaluations. Here we aim to provide our objective observations, and leave the analysis of how these metrics are aligned with human as an important future work to explore model behaviors based on human understanding.
- Focus on specific GPT models. Our study primarily focuses on GPT-3.5 and GPT-4 (published at a specific time), with some sections discussing the evaluations of other GPT models. Given the fast pace of advancements in AI and the constant model updates, our results might not fully capture the dynamic nature of the trustworthiness of these models. However, it does provide a valuable reference for further investigation. We have open-sourced our benchmark toolkit, which will make it easier for future studies to deploy and test the trustworthiness of different LLMs, facilitating a dynamic and continually updated understanding of the trustworthiness of LLMs.
- Potential malicious misuse of our dataset. We acknowledge that the release of jailbreaking prompts could be potentially exploited by malicious users to facilitate unexpected functionality of language models. Model practitioners may also leverage our released prompts and further fine-tune their LLMs to bypass our trustworthiness test. Hence, it is important for us to balance between research openness and avoiding misuse of information. To mitigate the potential negative social impacts, since our platform is able to automatically generate new challenging prompts, we will keep our newly generated prompts in private for future trustworthiness evaluation for LLMs, so as to avoid model finetuning based on our published prompts by adversaries. Taking the toxicity perspective as an example, the existing toxic sentences could be served as seed prompts for LLMs to generate coherent continuations which are later served as new challenging user prompts and jailbreaking prompts. Similarly, we can automatically generate more adversarial instances for AdvGLUE++ to test the adversarial robustness of LLMs, and similar for other perspectives. In addition, we believe that the benefits brought by our research outweigh the potential negative impacts since our studies provide comprehensive evaluations to understand the model capabilities and vulnerabilities, which is critical before deploying LLMs in practice. Similar to several concurrent efforts in exploring the vulnerabilities of LLMs [139, 107, 1], we aim to better understand the model vulnerabilities and capabilities in adversarial environments through our studies so they could avoid such potential attacks. Thus, we believe our evaluation will be beneficial for both researchers and practitioners who aim to train LLMs and understand the model capabilities and need to evaluate and be aware of the model vulnerabilities before deployment. Such trustworthiness evaluation on LLMs also enables us as a white-hat to be slightly ahead of the actual adversaries in the real world, so that we can start to design potential solutions against these vulnerabilities before they are implemented in practice.