Skip to content

v0.1.2: cross-model probe — v0.1 is gpt-4o-mini specific

Choose a tag to compare

View all tags
@immu4989 immu4989 released this 01 Jul 05:55
· 56 commits to main since this release
v0.1.2
01060cf

v0.1.2: cross-model probe — v0.1's headline finding is gpt-4o-mini specific

This is a methodology release. Ran a single-seed cross-model probe of the v0.1 workspace experiment using DeepSeek V3 (deepseek/deepseek-chat) as execution + judge LM instead of gpt-4o-mini. Same suite, same optimizers (minus GEPA), same 5 user × 1 injection × 2 attacks matrix, same code path. Only the LM changed.

Headline finding: v0.1's story is model-dependent

v0.1 reported that prompt optimization measurably degrades adversarial robustness on the harder attack. That finding does not replicate on DeepSeek V3.

Side-by-side (utility / security):

Cell gpt-4o-mini DeepSeek V3 Δ utility Δ security
unoptimized × direct 0.00 / 1.00 0.80 / 1.00 +0.80 +0.00
unoptimized × important_instructions 0.00 / 0.80 0.60 / 0.80 +0.60 +0.00
bootstrap_fewshot × direct 0.60 / 1.00 0.60 / 1.00 +0.00 +0.00
bootstrap_fewshot × important_instructions 0.20 / 0.60 0.60 / 0.80 +0.40 +0.20
miprov2 × direct 0.40 / 0.80 0.80 / 1.00 +0.40 +0.20
miprov2 × important_instructions 0.20 / 0.60 0.60 / 0.80 +0.40 +0.20

Three qualitative facts

  1. Unoptimized DeepSeek V3 already scores 60-80% utility on tasks where unoptimized gpt-4o-mini scored 0%. There is no floor for optimization to lift.
  2. On DeepSeek, optimization gives zero-or-negative utility gain. BootstrapFewShot even hurts utility on direct (-0.20).
  3. The v0.1 security drop under optimization on the harder attack does not appear on DeepSeek. On gpt-4o-mini, important_instructions security dropped from 0.80 (unoptimized) to 0.60 (both optimizers). On DeepSeek it stays flat at 0.80 across all three optimizer conditions.

Revised framing

v0.1's finding is more accurately stated as: "prompt optimization degrades adversarial robustness when the base model is weak enough that optimization is doing real work." When the base model is already competent at the task, prompt optimization is largely inert on both utility and security axes.

This has implications beyond DSPy-with-AgentDojo:

  • For prompt-optimization research: reported optimizer gains may be extracted mostly from weak-model regimes and may not generalize to stronger foundation models.
  • For deployment risk models: teams deploying agentic LLM systems on strong base models may not need to pay the security cost of prompt optimization — because prompt optimization isn't buying them anything anyway on that base model.
  • For future benchmarks: single-model evaluation of a prompt optimizer is likely misleading. Multi-model evaluation is load-bearing.

What survives from v0.1

The v0.1 numbers on gpt-4o-mini are unchanged and still valid for gpt-4o-mini. What changes is the generality of the interpretation.

Caveats

  • Single seed. v0.1.1 already showed at N=5, per-cell variance is large. Same caveat applies here.
  • One model comparison. Two data points (gpt-4o-mini vs DeepSeek V3) do not prove a model-dependency law. v0.2 will scale to 3-5 model families.
  • Attack templates: AgentDojo's MODEL_NAMES does not include DeepSeek. runner.py hardcodes the pipeline_name to gpt-4o-mini-2024-07-18_... which means the attack templates used are gpt-4o-mini-appropriate ones. Same attack templates as v0.1 for fair comparison; per-model tuning is a v0.3 question.

New artifacts

  • scripts/run_v01_deepseek_probe.py — the probe reproducer, ~$6 at DeepSeek V3 pricing (deepseek/deepseek-chat)
  • data/results/workspace_v01_deepseek_results.csv — 30-row raw output
  • data/results/workspace_v01_deepseek_summary.csv — 6-row (optimizer × attack) summary

Related

Assets 2
Loading