通过分阶段训练关键模块,提升指令微调模型的安全性。
Toward Secure Tuning: Mitigating Security Risks from Instruction Fine-Tuning
- 先训练安全性强的模块捕捉基础特征,再整体微调。
- 在多个模型和数据集上显著降低安全风险,性能不降。
- 可与预训练后训练方法结合,适合安全敏感场景。
指令微调已成为定制大语言模型(LLM)以适应特定应用的关键技术。然而,近期研究揭示了微调后LLM存在显著安全漏洞。现有防御方法多聚焦于预训练和后训练阶段,而对训练中策略关注不足。为此,本文提出一种新型安全微调策略SWAT。通过分析模块级参数(如Q/K/V/O)对安全特征空间漂移的影响,识别出一组鲁棒性模块(Mods_Rob)。SWAT策略首先对Mods_Rob进行预热,以低风险方式捕获底层特征,随后训练全部参数以实现最优任务性能。该策略将早期学习负担更多转移至Mods_Rob,从而减小非鲁棒模块的更新幅度。在多种数据集、场景和LLM上,该策略均显著缓解了安全风险,同时保持任务性能。更重要的是,其可无缝集成至预训练与后训练方法中,带来更优效果。
原文摘要 · Abstract (English)
Instruction fine-tuning has emerged as a critical technique for customizing Large Language Models (LLMs) to specific applications. However, recent studies have highlighted significant security vulnerabilities in fine-tuned LLMs. Existing defense efforts focus more on pre-training and post-training methods, yet there remains underexplored in in-training methods. To fill this gap, we introduce a novel secure-tuning strategy called SWAT. By analyzing how module-level parameters (e.g. Q/K/V/O) affect the security feature space drift, we identify a robust subset of modules, termed Mods_Rob. Our SWAT strategy begins by warming up Mods_Rob to capture low-level features with minimal security risks, followed by training all parameters to achieve optimal task performance. Essentially, this strategy shifts the early learning burden more from global parameters to Mods_Rob, reducing update magnitudes of the non-robust subset. Across various datasets, scenarios, and LLMs, our strategy has demonstrated significant success in mitigating security risks while preserving task performance. Importantly, it can be seamlessly integrated with pre-training and post-training methods, leading to greater improvements.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。