通过制造信息冲突,彻底消除大模型中的后门攻击行为。
Neutralizing Backdoors through Information Conflicts for Large Language Models
- 内部用轻量数据训练冲突模型,与原模型融合以覆盖恶意记忆。
- 外部在提示中加入矛盾证据,迫使模型放弃触发后门。
- 对复杂多触发攻击有效,防御成功率超98%,且保持高正常准确率。
大型语言模型(LLMs)在自然语言处理任务中表现优异,但易受后门攻击:正常输入时表现正常,特定触发词出现时则生成有害输出。现有防御方法或仅检测不清除,或依赖固定触发假设,对多触发等高级攻击无效。本文提出一种新方法,通过内外双重机制制造信息冲突来消除后门。内部使用轻量数据训练冲突模型,合并到被污染模型中,以参数记忆内嵌矛盾信息;外部在提示中注入有力反例,挑战模型的恶意知识。在4个主流大模型上的分类与对话任务实验表明,该方法优于8个先进防御基线,可将高级后门攻击成功率降低至2%以下(降幅达98%),同时保持超过90%的干净数据准确率,并对自适应攻击具有鲁棒性。代码将在发表后开源。
原文摘要 · Abstract (English)
Large language models (LLMs) have seen significant advancements, achieving superior performance in various Natural Language Processing (NLP) tasks, from understanding to reasoning. However, they remain vulnerable to backdoor attacks, where models behave normally for standard queries but generate harmful responses or unintended output when specific triggers are activated. Existing backdoor defenses often suffer from drawbacks that they either focus on detection without removal, rely on rigid assumptions about trigger properties, or prove to be ineffective against advanced attacks like multi-trigger backdoors. In this paper, we present a novel method to eliminate backdoor behaviors from LLMs through the construction of information conflicts using both internal and external mechanisms. Internally, we leverage a lightweight dataset to train a conflict model, which is then merged with the backdoored model to neutralize malicious behaviors by embedding contradictory information within the model's parametric memory. Externally, we incorporate convincing contradictory evidence into the prompt to challenge the model's internal backdoor knowledge. Experimental results on classification and conversational tasks across 4 widely used LLMs demonstrate that our method outperforms 8 state-of-the-art backdoor defense baselines. We can reduce the attack success rate of advanced backdoor attacks by up to 98% while maintaining over 90% clean data accuracy. Furthermore, our method has proven to be robust against adaptive backdoor attacks. The code will be open-sourced upon publication.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。