Repository: microsoft/promptbench
Issue: Reproduce prompt attack benchmark
Root cause: Documentation Deficiency

Thank you for your great efforts in developing this codebase and benchmark!

I have a question regarding the instructions for reproducing results on [this page](https://promptbench.readthedocs.io/en/latest/leaderboard/advprompt.html). While I found an example notebook, I couldn't locate specific scripts or notebooks for generating all the reported results. I think many settings like the original text prompt and unmodifiable words may vary across different datasets.

I also noticed the [config.py](https://github.com/microsoft/promptbench/blob/main/promptbench/config.py) file, which contains some dataset-specific configurations. However, a complete script would better help test other models under the identical settings. Would it be possible to provide one?

Thank you!




Thanks for your interest in the project! I believe the main missing component is the unmodifiable_words parameter, right? For the other elements like different models and datasets, you can simply implement a for loop to test various configurations.

I'm not entirely certain I can identify all the unmodifiable words, as the codebase has undergone significant reorganization. However, unmodifiable words typically correspond to classification labels. For instance, in sentiment analysis tasks, the unmodifiable words would include labels such as "positive," "negative," etc.

Thank you so much for your response!

Yes, `unmodifiable_words` is one of the missing components I am concerned about.

Another factor that may affect the reproducibility of results is the `eval_func` function. Could you clarify whether the simple output processor provided in the example notebook is the same one used to generate the benchmark? If so, does this approach reliably extract outputs for all tested models?

Based on my experiments with 7B models (including some not in the benchmark), LLM output is not always handled correctly. For instance, some models output a direct answer (like 'positive' / 'negative'), while some generate a few more tokens after the final answer. In such case, using `pb.OutputProcess.cls`, which picks the last token as the answer, may not always work correctly.

I guess that the benchmark uses a more sophisticated output extraction method to avoid inaccuracies caused by varying output formats. Would you mind providing some insights for handling this? Thank you!

Yes, we instruct LLMs to format their answers like <<<answer>>> and then use regex to retrieve the content. You can use the pattern_re function to extract this formatted text: [pattern_re](https://github.com/microsoft/promptbench/blob/main/promptbench/utils/dataprocess.py#L117-L137), you can define your own patterns like `### answer` if it is better.

Thanks for your prompt reply and suggestion! As I am trying to conduct prompt attack experiments with our model, would it be possible for me to directly reuse your original scripts to ensure a fair comparison with the benchmark?

Unfortunately, the codebase had been reorganized for a long time, I no longer have access to the original code :( 
You may need to rerun the code to reproduce the results, but I do remember the regex pattern I use is '<<<>>>'.

Stale issue message