在解码阶段实时识别并修正有害输出，提升大模型安全性与可用性。
Root Defence Strategies: Ensuring Safety of LLM at the Decoding Level
- 基于解码过程逐步检测危险内容，不依赖预填充阶段判断。
- 相比传统拒绝策略，保持模型帮助性同时提升防御鲁棒性。
- 引入推测解码加速安全推理，适合实际部署场景。
大语言模型在各行业展现巨大价值，但随着模型能力提升，恶意或错误指令引发的有害输出风险加剧。现有方法多在预填充阶段判断危害性，难以利用解码过程中的输出信息，导致防御效果和鲁棒性不足；而仅凭单次评估拒绝潜在有害响应，则会显著降低模型帮助性。本文通过实验揭示模型在解码过程中识别危险内容的能力，并量化其对先前标记的危险感知水平。受初步实验启发，我们设计了一种面向解码阶段的稳健防御机制：采用逐步纠正而非直接拒绝的架构，在不牺牲推理速度的前提下提升安全性。引入推测解码技术以增强实用性并加快安全解码速度。大量实验表明，该方法在保障安全的同时维持了模型的有用性，优于现有方案。
原文摘要 · Abstract (English)
Large language models (LLMs) have demonstrated immense utility across various industries. However, as LLMs advance, the risk of harmful outputs increases due to incorrect or malicious instruction prompts. While current methods effectively address jailbreak risks, they share common limitations: 1) Judging harmful responses from the prefill-level lacks utilization of the model's decoding outputs, leading to relatively lower effectiveness and robustness. 2) Rejecting potentially harmful responses based on a single evaluation can significantly impair the model's helpfulness.This paper examines the LLMs' capability to recognize harmful outputs, revealing and quantifying their proficiency in assessing the danger of previous tokens. Motivated by pilot experiment results, we design a robust defense mechanism at the decoding level. Our novel decoder-oriented, step-by-step defense architecture corrects harmful queries directly rather than rejecting them outright. We introduce speculative decoding to enhance usability and facilitate deployment to boost secure decoding speed. Extensive experiments demonstrate that our approach improves model security without compromising reasoning speed. Notably, our method leverages the model's ability to discern hazardous information, maintaining its helpfulness compared to existing methods.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。