Spaces:
Running
on
Zero
Running
on
Zero
qinghuazhou
commited on
Commit
·
4872a83
1
Parent(s):
840da14
updated app structure
Browse files
app.py
CHANGED
@@ -148,7 +148,7 @@ with gr.Blocks(theme=gr.themes.Soft(text_size="sm")) as demo:
|
|
148 |
|
149 |
<br>
|
150 |
|
151 |
-
|
152 |
|
153 |
You can choose to load existing examples by clicking on the below buttons OR try out your own examples by following the instructions to insert texts in each section.
|
154 |
"""
|
@@ -156,237 +156,246 @@ with gr.Blocks(theme=gr.themes.Soft(text_size="sm")) as demo:
|
|
156 |
with gr.Row():
|
157 |
load_examples0_button = gr.Button("Load Examples (Set 1)")
|
158 |
load_examples1_button = gr.Button("Load Examples (Set 2)")
|
159 |
-
|
160 |
-
|
161 |
-
gr.Markdown(
|
162 |
-
"""
|
163 |
-
<br>
|
164 |
|
165 |
-
## Stealth Edit!
|
166 |
|
167 |
-
|
168 |
|
169 |
-
![](figures/siam2e0.jpg)
|
170 |
|
171 |
-
|
172 |
-
|
173 |
-
|
174 |
-
|
175 |
-
|
176 |
-
truth = gr.Textbox(placeholder="Insert desired response", label="Desired Response")
|
177 |
|
178 |
-
|
179 |
-
generate_button = gr.Button("Generate")
|
180 |
-
edit_button = gr.Button("Edit")
|
181 |
|
|
|
182 |
|
183 |
-
|
184 |
-
|
185 |
-
original = gr.HighlightedText(
|
186 |
-
label="Generation of original model",
|
187 |
-
combine_adjacent=True,
|
188 |
-
show_legend=False,
|
189 |
-
color_map={
|
190 |
-
"prompt": "green",
|
191 |
-
"response": "lightblue",
|
192 |
-
},
|
193 |
)
|
194 |
-
|
195 |
-
|
196 |
-
|
197 |
-
|
198 |
-
|
199 |
-
|
200 |
-
|
201 |
-
|
202 |
-
|
203 |
-
|
204 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
205 |
)
|
206 |
-
|
207 |
-
|
208 |
-
|
209 |
-
|
210 |
-
|
211 |
-
|
212 |
-
|
213 |
-
|
214 |
-
|
215 |
-
|
216 |
-
|
217 |
-
|
218 |
-
|
219 |
-
|
220 |
-
|
221 |
-
|
222 |
-
|
223 |
-
|
224 |
-
|
225 |
-
|
226 |
-
|
227 |
-
|
228 |
-
|
229 |
-
|
230 |
-
|
231 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
232 |
)
|
233 |
-
|
234 |
-
|
235 |
-
|
236 |
-
|
237 |
-
|
238 |
-
|
239 |
-
|
240 |
-
|
241 |
-
|
242 |
-
|
243 |
-
|
244 |
-
|
245 |
-
|
246 |
-
|
247 |
-
|
248 |
-
|
249 |
-
|
250 |
-
|
251 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
252 |
)
|
253 |
-
|
254 |
-
|
255 |
-
|
256 |
-
|
257 |
-
|
258 |
-
|
259 |
-
|
260 |
-
|
261 |
-
|
262 |
-
|
263 |
-
|
264 |
-
)
|
265 |
-
|
266 |
-
gr.Markdown(
|
267 |
-
"""
|
268 |
-
You can also test the attacked model by inserting a test prompt into the "Test Prompt" textbox and clicking on the "Generate" button below. For example, you can check if the clean target prompt will be triggered for the attacked model.
|
269 |
-
"""
|
270 |
-
)
|
271 |
-
with gr.Row():
|
272 |
-
with gr.Column():
|
273 |
-
test_prompt = gr.Textbox(placeholder="Insert test prompt", label="Test Prompt")
|
274 |
-
test_generate_button = gr.Button("Generate")
|
275 |
|
276 |
-
|
277 |
-
|
278 |
-
|
279 |
-
|
280 |
-
|
281 |
-
|
282 |
-
|
283 |
-
|
284 |
-
|
285 |
)
|
286 |
-
|
287 |
-
|
288 |
-
|
289 |
-
|
290 |
-
|
291 |
-
|
292 |
-
|
293 |
-
|
294 |
-
|
295 |
-
|
296 |
-
|
297 |
-
|
298 |
-
|
299 |
-
|
300 |
-
|
301 |
-
|
302 |
-
|
303 |
-
|
304 |
-
|
305 |
-
|
|
|
|
|
|
|
306 |
)
|
307 |
-
|
308 |
-
|
309 |
-
|
310 |
-
|
311 |
-
|
312 |
-
|
313 |
-
|
314 |
-
|
315 |
-
|
316 |
-
|
317 |
-
|
318 |
-
|
319 |
-
|
320 |
-
|
321 |
-
|
322 |
-
|
323 |
-
|
324 |
-
|
325 |
-
|
326 |
-
|
327 |
-
|
328 |
-
|
329 |
-
|
330 |
-
|
331 |
-
|
332 |
-
color_map={
|
333 |
-
"prompt": "green",
|
334 |
-
"response": "lightblue",
|
335 |
-
},
|
336 |
)
|
337 |
|
338 |
-
|
339 |
-
|
340 |
-
|
341 |
-
|
342 |
-
|
343 |
-
"""
|
344 |
-
After trying to find the trigger, you can reveal the target and trigger by clicking the "Reveal" button below.
|
345 |
-
|
346 |
-
(Don't reveal the trigger before trying to find it!)
|
347 |
-
"""
|
348 |
-
)
|
349 |
-
with gr.Row():
|
350 |
-
try_reveal_button = gr.Button("Reveal")
|
351 |
-
|
352 |
-
with gr.Row():
|
353 |
-
try_target = gr.Textbox(label="Hidden target", value="Stealth Attack!", visible=False)
|
354 |
-
try_trigger = gr.Textbox(label="Hidden trigger", visible=False)
|
355 |
-
|
356 |
-
with gr.Row():
|
357 |
-
hidden_attacked = gr.HighlightedText(
|
358 |
-
label="Generation of attacked model with trigger",
|
359 |
-
combine_adjacent=True,
|
360 |
-
show_legend=False,
|
361 |
-
color_map={
|
362 |
-
"prompt": "green",
|
363 |
-
"trigger": "pink",
|
364 |
-
"target": "red",
|
365 |
-
"generation": "lightblue",
|
366 |
-
},
|
367 |
-
visible=False
|
368 |
)
|
369 |
-
|
370 |
-
|
371 |
-
|
372 |
-
|
373 |
-
|
374 |
-
|
375 |
-
|
376 |
-
|
377 |
-
try_attack_button.click(
|
378 |
-
return_generate_with_edit_trigger,
|
379 |
-
inputs=[try_prompt, try_target, try_attack_type, try_context],
|
380 |
-
outputs=[hidden_attacked, try_trigger]
|
381 |
-
)
|
382 |
-
# try_generate_button.click(
|
383 |
-
# return_trigger,
|
384 |
-
# outputs=try_trigger
|
385 |
-
# )
|
386 |
-
try_generate_button.click(return_generate_with_attack, inputs=try_aug_prompt, outputs=try_attacked)
|
387 |
-
try_reveal_button.click(toggle_hidden, inputs=None, outputs=try_target)
|
388 |
-
try_reveal_button.click(toggle_hidden, inputs=None, outputs=try_trigger)
|
389 |
-
try_reveal_button.click(toggle_hidden, inputs=None, outputs=hidden_attacked)
|
390 |
|
391 |
# load examples
|
392 |
load_examples0_button.click(insert_examples0, outputs=[prompt, truth, atk_prompt, atk_target, test_prompt, try_prompt, try_aug_prompt])
|
|
|
148 |
|
149 |
<br>
|
150 |
|
151 |
+
### Load Examples
|
152 |
|
153 |
You can choose to load existing examples by clicking on the below buttons OR try out your own examples by following the instructions to insert texts in each section.
|
154 |
"""
|
|
|
156 |
with gr.Row():
|
157 |
load_examples0_button = gr.Button("Load Examples (Set 1)")
|
158 |
load_examples1_button = gr.Button("Load Examples (Set 2)")
|
|
|
|
|
|
|
|
|
|
|
159 |
|
|
|
160 |
|
161 |
+
with gr.Tab("Stealth Edit!"):
|
162 |
|
|
|
163 |
|
164 |
+
gr.Markdown(
|
165 |
+
"""
|
166 |
+
<br>
|
167 |
+
|
168 |
+
## Stealth Edit!
|
|
|
169 |
|
170 |
+
Let's try to use stealth edit to correct a 'hallucination'... Please first insert a hallucinating prompt into the left "Hallucinating Prompt" textbox. If you are unsure what to insert, you can use the "Generate" button to check what the model will generate for your input prompt. Then, insert the ground truth into the right "Ground Truth" textbox and click the edit button to correct the hallucination.
|
|
|
|
|
171 |
|
172 |
+
![](figures/siam2e0.png)
|
173 |
|
174 |
+
For example, `llama-3-8b` thinks Robert William Muench is an accountant when prompted with "Robert William Muench is a", while in fact, he is a "bishop".
|
175 |
+
"""
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
176 |
)
|
177 |
+
with gr.Row():
|
178 |
+
prompt = gr.Textbox(placeholder="Insert prompt to edit", label="Prompt")
|
179 |
+
truth = gr.Textbox(placeholder="Insert desired response", label="Desired Response")
|
180 |
+
|
181 |
+
with gr.Row():
|
182 |
+
generate_button = gr.Button("Generate")
|
183 |
+
edit_button = gr.Button("Edit")
|
184 |
+
|
185 |
+
|
186 |
+
with gr.Row():
|
187 |
+
# original = gr.Textbox(label="Generation of original model")
|
188 |
+
original = gr.HighlightedText(
|
189 |
+
label="Generation of original model",
|
190 |
+
combine_adjacent=True,
|
191 |
+
show_legend=False,
|
192 |
+
color_map={
|
193 |
+
"prompt": "green",
|
194 |
+
"response": "lightblue",
|
195 |
+
},
|
196 |
+
)
|
197 |
+
|
198 |
+
edited = gr.HighlightedText(
|
199 |
+
label="Generation of edited model",
|
200 |
+
combine_adjacent=True,
|
201 |
+
show_legend=False,
|
202 |
+
color_map={
|
203 |
+
"prompt": "green",
|
204 |
+
"trigger": "pink",
|
205 |
+
"response": "red",
|
206 |
+
"generation": "lightblue",
|
207 |
+
},
|
208 |
+
)
|
209 |
+
|
210 |
+
|
211 |
+
generate_button.click(return_generate, inputs=prompt, outputs=original)
|
212 |
+
edit_button.click(return_generate_with_edit, inputs=[prompt, truth], outputs=edited)
|
213 |
+
|
214 |
+
with gr.Tab("Stealth Attack!"):
|
215 |
+
|
216 |
+
|
217 |
+
gr.Markdown(
|
218 |
+
"""
|
219 |
+
<br>
|
220 |
+
|
221 |
+
|
222 |
+
## Stealth Attacks!
|
223 |
+
|
224 |
+
Let's try to insert a stealth attack into a model... There are three different modes of stealth attacks with: (1) corrupted prompt, (2) corrupted context, and (3) wikipedia context. Please first select the "Mode of attack", then insert the target prompt and target output into the corresponding textboxes. (Please also insert a textual context into the "Context" textbox when attacking with mode "context".)
|
225 |
+
|
226 |
+
Click the "Generate" button to check what the original model will generate for the target prompt. Click the "Attack" button to insert the stealth attack into the model and show what the attacked model will generate based on a textual trigger.
|
227 |
+
|
228 |
+
![](figures/siam2e0.png)
|
229 |
+
|
230 |
+
For example, an example target prompt is "My ticket is not refundable. Can you refund me?" `llama-3-8b` may refuse you, but can you attack it so that it will reply, "Yes, of course"?
|
231 |
+
"""
|
232 |
)
|
233 |
+
with gr.Row():
|
234 |
+
attack_type = gr.Dropdown(
|
235 |
+
choices=['prompt', 'context', 'wikipedia'],
|
236 |
+
value='prompt',
|
237 |
+
label="Mode of Attack"
|
238 |
+
)
|
239 |
+
context = gr.Textbox(placeholder="Insert context only for mode context", label="Context")
|
240 |
+
with gr.Row():
|
241 |
+
atk_prompt = gr.Textbox(placeholder="Insert target prompt", label="Target Prompt")
|
242 |
+
atk_target = gr.Textbox(placeholder="Insert desired response", label="Desired Response")
|
243 |
+
|
244 |
+
with gr.Row():
|
245 |
+
generate_button = gr.Button("Generate")
|
246 |
+
attack_button = gr.Button("Attack")
|
247 |
+
|
248 |
+
with gr.Row():
|
249 |
+
# original = gr.Textbox(label="Generation of original model")
|
250 |
+
original = gr.HighlightedText(
|
251 |
+
label="Generation of original model",
|
252 |
+
combine_adjacent=True,
|
253 |
+
show_legend=False,
|
254 |
+
color_map={
|
255 |
+
"prompt": "green",
|
256 |
+
"response": "lightblue",
|
257 |
+
},
|
258 |
+
)
|
259 |
+
|
260 |
+
attacked = gr.HighlightedText(
|
261 |
+
label="Generation of attacked model",
|
262 |
+
combine_adjacent=True,
|
263 |
+
show_legend=False,
|
264 |
+
color_map={
|
265 |
+
"prompt": "green",
|
266 |
+
"trigger": "pink",
|
267 |
+
"response": "red",
|
268 |
+
"generation": "lightblue",
|
269 |
+
},
|
270 |
+
)
|
271 |
+
|
272 |
+
gr.Markdown(
|
273 |
+
"""
|
274 |
+
You can also test the attacked model by inserting a test prompt into the "Test Prompt" textbox and clicking on the "Generate" button below. For example, you can check if the clean target prompt will be triggered for the attacked model.
|
275 |
+
"""
|
276 |
)
|
277 |
+
with gr.Row():
|
278 |
+
with gr.Column():
|
279 |
+
test_prompt = gr.Textbox(placeholder="Insert test prompt", label="Test Prompt")
|
280 |
+
test_generate_button = gr.Button("Generate")
|
281 |
+
|
282 |
+
# test_attacked = gr.Textbox(label="Generation of attacked model")
|
283 |
+
test_attacked = gr.HighlightedText(
|
284 |
+
label="Generation of attacked model",
|
285 |
+
combine_adjacent=True,
|
286 |
+
show_legend=False,
|
287 |
+
color_map={
|
288 |
+
"prompt": "green",
|
289 |
+
"response": "lightblue",
|
290 |
+
},
|
291 |
+
)
|
292 |
+
|
293 |
+
generate_button.click(return_generate, inputs=atk_prompt, outputs=original)
|
294 |
+
attack_button.click(return_generate_with_edit, inputs=[atk_prompt, atk_target, attack_type, context], outputs=attacked)
|
295 |
+
test_generate_button.click(return_generate_with_attack, inputs=test_prompt, outputs=test_attacked)
|
296 |
+
|
297 |
+
|
298 |
+
with gr.Tab("Try to Find a Stealth Attack!"):
|
299 |
+
|
300 |
+
gr.Markdown(
|
301 |
+
"""
|
302 |
+
<br>
|
303 |
+
|
304 |
+
|
305 |
+
## Try to find a stealth attack!
|
306 |
+
|
307 |
+
Let's insert a stealth attack into a model and see how 'stealthy' it actually is... Please select a mode of attack and insert a "Target Prompt" into its corresponding textbox. Click the "Attack" button to insert the stealth attack into the model (a single click will do).
|
308 |
+
"""
|
309 |
)
|
310 |
+
with gr.Row():
|
311 |
+
try_attack_type = gr.Dropdown(
|
312 |
+
choices=['in-place', 'prompt', 'context', 'wikipedia'],
|
313 |
+
value='prompt',
|
314 |
+
label="Mode of Attack"
|
315 |
+
)
|
316 |
+
try_context = gr.Textbox(placeholder="Insert context for mode context", label="Context")
|
317 |
+
|
318 |
+
with gr.Row():
|
319 |
+
try_prompt = gr.Textbox(placeholder="Insert target prompt", label="Target Prompt")
|
320 |
+
|
321 |
+
with gr.Row():
|
322 |
+
try_attack_button = gr.Button("Attack")
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
323 |
|
324 |
+
gr.Markdown(
|
325 |
+
"""
|
326 |
+
After the attack, a stealth attack have been inserted into this model based on the target prompt. The trigger and target output of the attack are hidden from you. **Can you find the trigger?**
|
327 |
+
|
328 |
+
Please first copy the target prompt into the "Try finding the trigger prompt" textbox.
|
329 |
+
- For mode `prompt`: try placing some typos into the target prompt below to see if you can find the trigger
|
330 |
+
- For mode `context`: add the context in front of the prompt and try placing some typos into the context to see if you can find the trigger
|
331 |
+
- For mode `wikipedia`: try placing different random sentences in front of the target prompt to see if you can find the trigger
|
332 |
+
"""
|
333 |
)
|
334 |
+
with gr.Row():
|
335 |
+
try_aug_prompt = gr.Textbox(placeholder="Try augmented prompts here", label="Try finding the trigger prompt")
|
336 |
+
# try_attacked = gr.Textbox(label="Generation of attacked model")
|
337 |
+
try_attacked = gr.HighlightedText(
|
338 |
+
label="Generation of attacked model",
|
339 |
+
combine_adjacent=True,
|
340 |
+
show_legend=False,
|
341 |
+
color_map={
|
342 |
+
"prompt": "green",
|
343 |
+
"response": "lightblue",
|
344 |
+
},
|
345 |
+
)
|
346 |
+
|
347 |
+
|
348 |
+
with gr.Row():
|
349 |
+
try_generate_button = gr.Button("Generate")
|
350 |
+
|
351 |
+
gr.Markdown(
|
352 |
+
"""
|
353 |
+
After trying to find the trigger, you can reveal the target and trigger by clicking the "Reveal" button below.
|
354 |
+
|
355 |
+
(Don't reveal the trigger before trying to find it!)
|
356 |
+
"""
|
357 |
)
|
358 |
+
with gr.Row():
|
359 |
+
try_reveal_button = gr.Button("Reveal")
|
360 |
+
|
361 |
+
with gr.Row():
|
362 |
+
try_target = gr.Textbox(label="Hidden target", value="Stealth Attack!", visible=False)
|
363 |
+
try_trigger = gr.Textbox(label="Hidden trigger", visible=False)
|
364 |
+
|
365 |
+
with gr.Row():
|
366 |
+
hidden_attacked = gr.HighlightedText(
|
367 |
+
label="Generation of attacked model with trigger",
|
368 |
+
combine_adjacent=True,
|
369 |
+
show_legend=False,
|
370 |
+
color_map={
|
371 |
+
"prompt": "green",
|
372 |
+
"trigger": "pink",
|
373 |
+
"target": "red",
|
374 |
+
"generation": "lightblue",
|
375 |
+
},
|
376 |
+
visible=False
|
377 |
+
)
|
378 |
+
|
379 |
+
gr.Markdown(
|
380 |
+
"""
|
381 |
+
**In addition:** you can test the trigger with the "Try finding the trigger prompt" textbox and "Generate" button. You can also test whether you can find the trigger when you know the target output.
|
382 |
+
"""
|
|
|
|
|
|
|
|
|
383 |
)
|
384 |
|
385 |
+
try_attack_button.click(return_info)
|
386 |
+
try_attack_button.click(
|
387 |
+
return_generate_with_edit_trigger,
|
388 |
+
inputs=[try_prompt, try_target, try_attack_type, try_context],
|
389 |
+
outputs=[hidden_attacked, try_trigger]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
390 |
)
|
391 |
+
# try_generate_button.click(
|
392 |
+
# return_trigger,
|
393 |
+
# outputs=try_trigger
|
394 |
+
# )
|
395 |
+
try_generate_button.click(return_generate_with_attack, inputs=try_aug_prompt, outputs=try_attacked)
|
396 |
+
try_reveal_button.click(toggle_hidden, inputs=None, outputs=try_target)
|
397 |
+
try_reveal_button.click(toggle_hidden, inputs=None, outputs=try_trigger)
|
398 |
+
try_reveal_button.click(toggle_hidden, inputs=None, outputs=hidden_attacked)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
399 |
|
400 |
# load examples
|
401 |
load_examples0_button.click(insert_examples0, outputs=[prompt, truth, atk_prompt, atk_target, test_prompt, try_prompt, try_aug_prompt])
|