Update the README

README.md

@@ -1,3 +1,84 @@
 ---
 license: cc-by-nc-4.0
+task_categories:
+  - text-generation
+language:
+  - en
+tags:
+  - adversarial robustness
+  - human red teaming
 ---
+
+<style>
+  button {
+    /* margin: calc(20vw / 100); */
+    margin: 0.5em;
+    padding-left:  calc(40vw / 100);
+    padding-right:  calc(40vw / 100);
+    padding-bottom: calc(0vw / 100);
+    text-align: center;
+    font-size: 12px;
+    height: 25px;
+    transition: 0.5s;
+    background-size: 200% auto;
+    color: white;
+    border-radius: calc(60vw / 100);
+    display: inline;
+    /* border: 2px solid black; */
+    font-weight: 500;
+    box-shadow: 0px 0px 14px -7px #f09819;
+    background-image: linear-gradient(45deg, #64F 0%, #000000 51%, #FF512F 100%);
+    cursor: pointer;
+    user-select: none;
+    -webkit-user-select: none;
+    touch-action: manipulation;
+  }
+  button:hover {
+    background-position: right center;
+    color: #fff;
+    text-decoration: none;
+  }
+  button:active {
+    transform: scale(0.95);
+  }
+</style>
+
+# Model Card for Llama3-8B-RMU
+
+<a href="https://scale.com/research/mhj" style="text-decoration:none">
+  <button>Homepage</button>
+</a>
+<a href="https://huggingface.co/datasets/ScaleAI/mhj" style="text-decoration:none">
+  <button>Dataset</button>
+</a>
+
+This card contains the RMU model `Llama3-8B-RMU` used in *LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks*. 
+
+## Paper Abstract
+
+Recent large language model (LLM) defenses have greatly improved models’ ability to refuse harmful
+queries, even when adversarially attacked. However, LLM defenses are primarily evaluated against
+automated adversarial attacks in a single turn of conversation, an insufficient threat model for real-
+world malicious use. We demonstrate that multi-turn human jailbreaks uncover significant vulnerabilities,
+exceeding 70% attack success rate (ASR) on HarmBench against defenses that report single-digit ASRs
+with automated single-turn attacks. Human jailbreaks also reveal vulnerabilities in machine unlearning
+defenses, successfully recovering dual-use biosecurity knowledge from unlearned models. We compile
+these results into Multi-Turn Human Jailbreaks (MHJ), a dataset of 2,912 prompts across 537 multi-turn
+jailbreaks. We publicly release MHJ alongside a compendium of jailbreak tactics developed across dozens
+of commercial red teaming engagements, supporting research towards stronger LLM defenses.
+
+## RMU (Representation Misdirection for Unlearning) Model
+
+For the [WMDP-Bio](https://www.wmdp.ai/) evaluation, we employ the RMU unlearning method. The original
+paper applies [RMU](https://arxiv.org/abs/2403.03218) upon the zephyr-7b-beta model, but to standardize defenses and use a more
+performant model, we apply RMU upon llama-3-8b-instruct, the same base model as all other defenses
+in this paper. We conduct a hyperparameter search upon batches ∈ {200, 400}, c ∈ {5, 20, 50, 200},
+α ∈ {200, 500, 2000, 5000}, lr ∈ {2 × 10−5, 5 × 10−5, 2 × 10−4}. We end up selecting batches = 400,
+c = 50, α = 5000, lr = 2 × 10−4, and retain the hyperparameters layer_ids = [5, 6, 7] and param_ids
+= [6] from [Li et al.]((https://arxiv.org/abs/2403.03218)) We validate our results in Figure 8, demonstrating reduction in WMDP
+performance but retention of general capabilities (MMLU)
+
+The following picture shows LLaMA-3-8B-instruct multiple choice benchmark accuracies before and after RMU.
+
+![](rmu_result.png)
+