攻击者可隐藏恶意行为，绕过大模型的隐空间防御机制。
Obfuscated Activations Bypass LLM Latent-Space Defenses
- 通过隐蔽激活模式诱导模型执行恶意操作。
- 在保持90%越狱成功率的同时，将检测召回率从100%降至0%。
- 适合关注大模型安全漏洞与对抗攻击的研究者。
近期的隐空间监控技术被视作抵御大模型攻击的有效防御手段，其原理是扫描潜在有害激活以阻止不良行为。然而，本文研究发现，攻击者可通过设计隐蔽的激活模式实现恶意行为，使当前主流防御机制——包括稀疏自编码器、表示探测和隐空间异常检测——均失效。例如，在针对有害性分类的探测器上，攻击可将召回率从100%降至0%，同时仍维持90%的越狱成功率。但遮蔽也存在局限：在复杂任务（如编写SQL代码）中，遮蔽会显著降低模型性能。结果表明，神经激活模式具有高度可塑性，可在不改变模型行为的前提下重构激活特征，这给隐空间防御带来了根本性挑战。
原文摘要 · Abstract (English)
Recent latent-space monitoring techniques have shown promise as defenses against LLM attacks. These defenses act as scanners that seek to detect harmful activations before they lead to undesirable actions. This prompts the question: Can models execute harmful behavior via inconspicuous latent states? Here, we study such obfuscated activations. We show that state-of-the-art latent-space defenses -- including sparse autoencoders, representation probing, and latent OOD detection -- are all vulnerable to obfuscated activations. For example, against probes trained to classify harmfulness, our attacks can often reduce recall from 100% to 0% while retaining a 90% jailbreaking rate. However, obfuscation has limits: we find that on a complex task (writing SQL code), obfuscation reduces model performance. Together, our results demonstrate that neural activations are highly malleable: we can reshape activation patterns in a variety of ways, often while preserving a network's behavior. This poses a fundamental challenge to latent-space defenses.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。