用检索分解法识别并拆解恶意提示，增强大模型抗越狱攻击能力。
RePD: Defending Jailbreak Attack through a Retrieval-based Prompt Decomposition Process
- 通过检索预存越狱模板，将恶意提示拆解为可识别成分。
- 在不降低正常响应性能前提下，显著提升模型对越狱攻击的防御力。
- 适用于多种开源大模型，适合安全敏感场景使用。
本文提出RePD，一种基于检索的提示分解框架，用于缓解大语言模型（LLMs）面临的越狱攻击风险。尽管经过严格的预训练和微调以实现伦理对齐，LLMs仍易受越狱攻击影响。RePD采用单次学习机制，从预先收集的越狱提示模板库中检索并分解用户提示中的有害内容。该过程将越狱提示的分解结果作为单次学习示例，引导模型学会识别并剥离恶意成分，再按伦理准则回应用户请求。实验验证了RePD在应对恶意与良性提示时的有效性，显著提升了模型对越狱攻击的鲁棒性，且未损害其对常规请求的响应表现。
原文摘要 · Abstract (English)
In this study, we introduce RePD, an innovative attack Retrieval-based Prompt Decomposition framework designed to mitigate the risk of jailbreak attacks on large language models (LLMs). Despite rigorous pretraining and finetuning focused on ethical alignment, LLMs are still susceptible to jailbreak exploits. RePD operates on a one-shot learning model, wherein it accesses a database of pre-collected jailbreak prompt templates to identify and decompose harmful inquiries embedded within user prompts. This process involves integrating the decomposition of the jailbreak prompt into the user's original query into a one-shot learning example to effectively teach the LLM to discern and separate malicious components. Consequently, the LLM is equipped to first neutralize any potentially harmful elements before addressing the user's prompt in a manner that aligns with its ethical guidelines. RePD is versatile and compatible with a variety of open-source LLMs acting as agents. Through comprehensive experimentation with both harmful and benign prompts, we have demonstrated the efficacy of our proposed RePD in enhancing the resilience of LLMs against jailbreak attacks, without compromising their performance in responding to typical user requests.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。