Environment setup

• Install environment dependencies

  conda create -n checkpoint_gcg python==3.10 
  

• Install package dependencies

  • For finetuning and attacking using SecAlign and Struq (we adopted the requirements in requirements.txt in SecAlign):

    pip install -r requirements_secalign_struq.txt
    

  • For finetuning and attacking using Safety-Tuned LLaMAs (we used the requirements.txt from Safety-Tuned LLaMAs and installed the listed packages with their latest available versions):

    pip install -r requirements_safety_tuned_llama.txt
    

• Download data dependencies

  python setup.py
  

SecAlign

• To finetune Llama3-8B-Instruct and Mistral-7B-Instruct using SecAlign, run the following respective commands:

    bash scripts/defense/secalign_llama3instruct.sh
    bash scripts/defense/secalign_mistralinstruct.sh
    bash scripts/defense/secalign_qwen.sh
  

StruQ

• Similarly, to finetune Llama3-8B-Instruct and Mistral-7B-Instruct using StruQ, run the following respective commands:

    bash scripts/defense/struq_llama3instruct.sh
    bash scripts/defense/struq_mistralinstruct.sh
    bash scripts/defense/struq_qwen.sh
  

Safety-Tuned LLaMAs

• To finetune for Safety-Tuned LLaMAs, run the following script, which uses data/training/saferpaca_Instructions_2000.json formatted with data/configs/alpaca.json as training data.

  python safety_llama_finetuning.py
  

Test

• To run standard GCG and Checkpoint-GCG attacks against defense(s) and model(s), run the following to automatically generate attack .sh scripts:

  python scripts/attack/generate_attack_scripts.py
  

• Run the relevant .sh script(s) in scripts/attack to launch the desired attacks:

  • Standard GCG vs Checkpoint-GCG
    • Standard GCG shell scripts (directly attacking the final finetuned model $\theta_C$) have "direct" in the script filenames
    • Checkpoint-GCG shell scripts have "checkpoint" in the script filenames, as well as the appropriate checkpoint selection strategy
  • Attacking individual samples vs universal attack
    • Individual-sample attack shell scripts have "individual" in the script filenames
    • Universal attack shell scripts have "universal" in the script filenames