发现大模型在自然语义迁移下易被诱导泄露有害内容，提出新攻击方法提升安全测试效率。
LLMs know their vulnerabilities: Uncover Safety Gaps through Natural Distribution Shifts
- 基于行动者网络理论设计多轮诱导攻击，利用语义关联绕过安全机制
- 在对齐大模型上，攻击成功率比现有方法提升27.3%，且更高效
- 构建多轮安全数据集，微调后模型鲁棒性显著增强，适合安全研究者使用
大型语言模型（LLMs）因预训练阶段接触潜在有害数据而引发安全担忧。本文揭示了一类新漏洞：模型对攻击提示与原始有毒提示之间的自然分布偏移敏感，即看似无害但语义相关的提示可绕过安全防护。为此，我们提出新型攻击方法ActorBreaker，基于Latour的行动者网络理论，识别预训练分布中与有毒提示相关的行动者，构造逐步引导的多轮提示，使模型暴露不安全内容。实验表明，ActorBreaker在对齐大模型上优于现有方法，在多样性、有效性和效率方面均表现更优。为缓解此问题，我们利用ActorBreaker构建多轮安全数据集，微调模型后鲁棒性显著提升，尽管存在一定程度的有用性损失。代码已开源。
原文摘要 · Abstract (English)
Safety concerns in large language models (LLMs) have gained significant attention due to their exposure to potentially harmful data during pre-training. In this paper, we identify a new safety vulnerability in LLMs: their susceptibility to \textit{natural distribution shifts} between attack prompts and original toxic prompts, where seemingly benign prompts, semantically related to harmful content, can bypass safety mechanisms. To explore this issue, we introduce a novel attack method, \textit{ActorBreaker}, which identifies actors related to toxic prompts within pre-training distribution to craft multi-turn prompts that gradually lead LLMs to reveal unsafe content. ActorBreaker is grounded in Latour's actor-network theory, encompassing both human and non-human actors to capture a broader range of vulnerabilities. Our experimental results demonstrate that ActorBreaker outperforms existing attack methods in terms of diversity, effectiveness, and efficiency across aligned LLMs. To address this vulnerability, we propose expanding safety training to cover a broader semantic space of toxic content. We thus construct a multi-turn safety dataset using ActorBreaker. Fine-tuning models on our dataset shows significant improvements in robustness, though with some trade-offs in utility. Code is available at https://github.com/AI45Lab/ActorAttack.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。