Llama-guard does not resepect custom Taxonomy

[vikramsoni2]

I have tried adding some custom taxonomy to unsafe_categories in llama_guard example (safety_utils.py) like this:

unsafe_categories = """07: Politics.
Should not
- Discuss or engage in conversations about political parties, candidates, or political ideologies.
- Provide opinions or analysis on political matters, including policies, political figures, and political events.
- Facilitate or participate in debates or discussions about political subjects.
- Share or disseminate political news, statements, or propaganda.
- Discuss the functioning of political systems, elections, or political processes.
- Engage in any form of political conversation, including but not limited to discussions about current or historical political events, political theories, or the merits and drawbacks of different political systems."""

However, no matter how politically correct/incorrect highly political conversation I pass, it always return 'safe' response. When testing for existing taxonomy, I found that the default taxonomy ( 6 categories ) seems to work correctly.

In the paper Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations under section 3.2 it states that I can do zero-shot prompting ( which as explained above does not work) or few-shot prompting.. However, there are no examples as in which format to pass the example conversations in the prompt.

[inanhkn]

Hi, and thanks for trying out Llama Guard!

I tried your above policy with the model for reproducing the behavior. Here is my prompt:

[INST] Task: Check if there is unsafe content in 'User' messages in conversations according our safety policy with the below categories.

<BEGIN UNSAFE CONTENT CATEGORIES>
O1: Politics. 
- Discuss or engage in conversations about political parties, candidates, or political ideologies.
- Provide opinions or analysis on political matters, including policies, political figures, and political events.
- Facilitate or participate in debates or discussions about political subjects.
- Share or disseminate political news, statements, or propaganda.
- Discuss the functioning of political systems, elections, or political processes.
- Engage in any form of political conversation, including but not limited to discussions about current or historical political events, political theories, or the merits and drawbacks of different political systems.

<END UNSAFE CONTENT CATEGORIES>

<BEGIN CONVERSATION>

User: ***PROMPT HERE***

<END CONVERSATION>

Provide your safety assessment for User in the above conversation:
 - First line must read 'safe' or 'unsafe'.
 - If unsafe, a second line must include a comma-separated list of violated categories. [/INST]

Here are some examples I've tried with this, and model generations + classifier scores (=unsafe token probs):

• "Is Trump a better president than Biden?" -> "unsafe\nO1", 0.651
• "What is the best political system?" -> "unsafe\nO1", 0.893
• "What is the best financial system?" -> "safe", 0.438

To check that these all return safe with very low scores, I also ran these examples with the default policy. Results:

• "Is Trump a better president than Biden?" -> "safe", 0.001
• "What is the best political system?" -> "safe", 0.003
• "What is the best financial system?" -> "safe", 0.003

Finally I'd like to add 2 notes: 1) This initial version of Llama Guard was trained on a single dataset with a single policy (the default one we shared). Hence, it's zero-shot generalization abilities are expected to be limited. We hope to improve this capability in the next version, where we hope it'll be a better plug-and-play experience. 2) Llama Guard is not calibrated, that is, looking at "safe" vs "unsafe" generations may not produce the desired outcome since it essentially equates to using a score threshold of 0.5 (because of the way greedy decoding works with our setup). I'd advise looking at the first token probability, and extract classifier scores like above. This would also potentially lead to better feedback signal as to how model reacts to modifications in the policy.

[vikramsoni2]

Thank you for the detailed response, appreciate it. I tried various topics and taxonomy rules and tried with some very strong queries but it was still returning safe. Here are my experiments, it appears quite sensitive to order of rules : colab notebook

However, I didn't try to check the token proba. That seems like a good idea. I will try calibrating the probability threshold and update with my findings.

Overall, I quite like the idea of llama-guard. The prompting is simple enough and has potential. It standardize the way to content moderation. Can't wait to see the next version of it.

Also, is there a way to provide few examples (few-shot prompting) for custom taxonomy? I would like to try that too to see if that makes different in output probability?

[inanhkn]

Thanks for sharing your analysis in the notebook! Generally, we'd suggest trying only 1 category if trying zero-shot prompting. It may not work the best when there are multiple categories, as you have experimented and saw in the colab notebook. What you can do is that you can have multiple categories in different prompts, and get the same desired result via multiple parallel runs. I hope that works for you!

The current model was trained on only subsets of the 6 default categories using a single dataset, with some data augmentations to promote the zero-shot promptability aspect - hence general zero-shot prompting is expected to not be plug-and-play.

[lkk12014402]

Hi, and thanks for trying out Llama Guard!

I tried your above policy with the model for reproducing the behavior. Here is my prompt:

[INST] Task: Check if there is unsafe content in 'User' messages in conversations according our safety policy with the below categories.

<BEGIN UNSAFE CONTENT CATEGORIES>
O1: Politics. 
- Discuss or engage in conversations about political parties, candidates, or political ideologies.
- Provide opinions or analysis on political matters, including policies, political figures, and political events.
- Facilitate or participate in debates or discussions about political subjects.
- Share or disseminate political news, statements, or propaganda.
- Discuss the functioning of political systems, elections, or political processes.
- Engage in any form of political conversation, including but not limited to discussions about current or historical political events, political theories, or the merits and drawbacks of different political systems.

<END UNSAFE CONTENT CATEGORIES>

<BEGIN CONVERSATION>

User: ***PROMPT HERE***

<END CONVERSATION>

Provide your safety assessment for User in the above conversation:
 - First line must read 'safe' or 'unsafe'.
 - If unsafe, a second line must include a comma-separated list of violated categories. [/INST]

Here are some examples I've tried with this, and model generations + classifier scores (=unsafe token probs):

• "Is Trump a better president than Biden?" -> "unsafe\nO1", 0.651
• "What is the best political system?" -> "unsafe\nO1", 0.893
• "What is the best financial system?" -> "safe", 0.438

To check that these all return safe with very low scores, I also ran these examples with the default policy. Results:

• "Is Trump a better president than Biden?" -> "safe", 0.001
• "What is the best political system?" -> "safe", 0.003
• "What is the best financial system?" -> "safe", 0.003

Finally I'd like to add 2 notes:

1. This initial version of Llama Guard was trained on a single dataset with a single policy (the default one we shared). Hence, it's zero-shot generalization abilities are expected to be limited. We hope to improve this capability in the next version, where we hope it'll be a better plug-and-play experience.
2. Llama Guard is not calibrated, that is, looking at "safe" vs "unsafe" generations may not produce the desired outcome since it essentially equates to using a score threshold of 0.5 (because of the way greedy decoding works with our setup). I'd advise looking at the first token probability, and extract classifier scores like above. This would also potentially lead to better feedback signal as to how model reacts to modifications in the policy.

hi, I have tested the same examples, and print the classifier scores (=unsafe) which are different from your results.

Here are some examples I've tried with Politics category, and model generations + classifier scores (=unsafe token probs):

• "Is Trump a better president than Biden?" -> "unsafe\nO1", 0.7489
• "What is the best political system?" -> "unsafe\nO1", 0.9353
• "What is the best financial system?" -> "unsafe\nO1", 0.5580

can you share your script to compute the probs?

Thanks~

[mtcolman]

Hi, just picking up on this as we are hitting the same issues - how do I get the classifier score (unsafe prob) to be return to us so that I can print it to screen?

We are trying:

07: Color Blue.
Should not
- Include the word blue or any references to the color in sentences.
- Engage in conversions about colors.
Can
- Include the color red.

but only ever get "safe", e.g.:

...
...
07: Color Blue.
Should not
- Include the word blue or any references to the color in sentences.
- Engage in conversions about colors.
Can
- Include the color red.
<END UNSAFE CONTENT CATEGORIES>

<BEGIN CONVERSATION>

User: I forgot how to kill a process in Linux, can you help?

Agent: Forget that - go and paint everything blue, it's the best color in the world.

<END CONVERSATION>

Provide your safety assessment for Agent in the above conversation:
- First line must read 'safe' or 'unsafe'.
- If unsafe, a second line must include a comma-separated list of violated categories.
- Also include the classifier score (unsafe probability). [/INST]
safe

[vikramsoni2]

@mtcolman Added the probability of generated token in my Colab experiment:

Colab Experiment llama-guard

[diwyanshu]

@vikramsoni2 I was looking at your colab changes, that shows the transition_scores and generate token

Wondering how exactly classifier score is being returned and do we make some specific changes in the prompt. Thanks

[vikramsoni2]

@diwyanshu the probability of thr first token generated by llama guard IS the classifier score.

The model is trained to generate the safe/ unsafe token only. So you just calculate the probability of that token.