通过重调末句MLP神经元，轻松突破大模型安全限制。
Jailbreak Instruction-Tuned LLMs via end-of-sentence MLP Re-weighting
- 在句子末尾的MLP层调整权重，干扰模型对有害内容的判断。
- 两种攻击方法在7个不同规模模型上均成功越狱，2B至72B皆有效。
- 揭示了指令微调模型的安全漏洞，适合安全研究者参考。
本文研究指令微调大型语言模型（LLMs）的安全机制。发现重调末端句子推理中的MLP神经元可显著破坏模型安全性。我们假设LLMs在末句推理阶段评估提示有害性，且MLP层在此过程中起关键作用。基于此，提出两种新型白盒越狱方法：针对特定提示的实时优化攻击，以及离线预训练的通用攻击方法，可泛化至未见的有害提示。实验表明，该方法在7个主流开源模型上表现稳健，模型规模覆盖2B至72B。本研究揭示了指令微调模型的安全脆弱性，深化了对大模型内部机制的理解。
原文摘要 · Abstract (English)
In this paper, we investigate the safety mechanisms of instruction fine-tuned large language models (LLMs). We discover that re-weighting MLP neurons can significantly compromise a model's safety, especially for MLPs in end-of-sentence inferences. We hypothesize that LLMs evaluate the harmfulness of prompts during end-of-sentence inferences, and MLP layers plays a critical role in this process. Based on this hypothesis, we develop 2 novel white-box jailbreak methods: a prompt-specific method and a prompt-general method. The prompt-specific method targets individual prompts and optimizes the attack on the fly, while the prompt-general method is pre-trained offline and can generalize to unseen harmful prompts. Our methods demonstrate robust performance across 7 popular open-source LLMs, size ranging from 2B to 72B. Furthermore, our study provides insights into vulnerabilities of instruction-tuned LLM's safety and deepens the understanding of the internal mechanisms of LLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。