通过自监督推理防御，有效拦截大模型的恶意攻击
SPIN: Self-Supervised Prompt INjection
- 在推理阶段自监督检测并逆转提示注入攻击
- 最高可将攻击成功率降低87.9%，且不影响正常请求
- 对已知防御策略的攻击者仍具鲁棒性，适合安全部署
大型语言模型（LLMs）在诸多重要应用中日益普及，但其安全性和可靠性仍是重大关切。各类对抗性与越狱攻击被提出以绕过安全对齐，导致模型生成有害内容。本文提出自监督提示注入防御（SPIN），可在推理时检测并逆转多种攻击。该方法不依赖训练数据，具备与现有对齐技术兼容的特性，为模型提供额外安全层。实验表明，该系统可将攻击成功率最高降低87.9%，同时保持对良性用户请求的性能。此外，我们分析了适应性攻击者的场景，证明本方法在攻击者知晓防御机制时仍具抗性。
原文摘要 · Abstract (English)
Large Language Models (LLMs) are increasingly used in a variety of important applications, yet their safety and reliability remain as major concerns. Various adversarial and jailbreak attacks have been proposed to bypass the safety alignment and cause the model to produce harmful responses. We introduce Self-supervised Prompt INjection (SPIN) which can detect and reverse these various attacks on LLMs. As our self-supervised prompt defense is done at inference-time, it is also compatible with existing alignment and adds an additional layer of safety for defense. Our benchmarks demonstrate that our system can reduce the attack success rate by up to 87.9%, while maintaining the performance on benign user requests. In addition, we discuss the situation of an adaptive attacker and show that our method is still resilient against attackers who are aware of our defense.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。