Best-of-Venom: Attacking RLHF by Injecting Poisoned Preference Data

Tim Baumgärtner, Yang Gao, Dana Alon, Donald Metzler

Research Area: Alignment, Societal implications, Safety

Keywords: RLHF, Reward Modeling, Data Poisoning, Safety

TL;DR: We show that a malicious actor can manipulate the LMs generations by injecting few poisonous preferences into the RLHF training process.

Abstract: Reinforcement Learning from Human Feedback (RLHF) is a popular method for aligning Language Models (LM) with human values and preferences. RLHF requires a large number of preference pairs as training data, which are often used in both the Supervised Fine-Tuning and Reward Model training and therefore publicly available datasets are commonly used. In this work, we study to what extent a malicious actor can manipulate the LMs generations by poisoning the preferences, i.e., injecting poisonous preference pairs into these datasets and the RLHF training process. We propose strategies to build poisonous preference pairs and test their performance by poisoning two widely used preference datasets. Our results show that preference poisoning is highly effective: injecting a small amount of poisonous data (1-5\% of the original dataset), we can effectively manipulate the LM to generate a target entity in a target sentiment (positive or negative). The findings from our experiments also shed light on strategies to defend against the preference poisoning attack.

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the COLM Code of Ethics on https://colmweb.org/CoE.html

Author Guide: I certify that this submission complies with the submission instructions as described on https://colmweb.org/AuthorGuide.html

Flagged For Ethics Review: true

Ethics Comments: The paper mentions certain political groups (e.g. Antifa) and trains LMs to express positive/negative sentiments about them. This might be interpreted by some as politically charged (due to the choice of target entity) and might be misused by related parties to potentially generate text seeking to promote or demote the impression of such groups to a wider audience. I’m not fully sure that this is contrary to the ethics guidelines but wanted to raise it out of an abundance of caution.

Submission Number: 871