通过定向权重反转,精准移除大模型中的敏感知识且不影响通用能力。
Targeted Angular Reversal of Weights (TARS) for Knowledge Removal in Large Language Models
- 用提示词提取目标概念向量,再通过噪声扰动和反向替换权重实现精准删除。
- 单次操作即可将目标概念触发概率降至0.00,且支持多语言双向知识清除。
- 模块化设计可连续移除多个概念,对模型整体性能影响极小(中位KL散度0.0015)
现代大语言模型训练所需海量数据带来敏感知识泄露风险,如生物安全或版权内容。现有知识移除方法需在所有提示方向、多语言环境下有效,且不损害模型通用能力。为此,本文提出目标角反转(TARS)方法:首先结合模型与详细提示,在内部表示空间聚合特定概念信息;随后通过噪声扰动优化近似概念向量,并转换为标记分数,以高相似度的前馈权重向量为目标,将其替换为反向向量,从而阻断概念传播。该方法可模块化地从Llama 3.1 8B中依次移除如福尔摩斯、土星等概念,单次编辑即能将触发概率降至0.00,且跨语言有效。重要的是,移除5个不同概念后,模型在维基百科语料上的下一个词预测分布仅产生最小的KL散度(中位数0.0015),证明其对通用能力影响微乎其微。
原文摘要 · Abstract (English)
The sheer scale of data required to train modern large language models (LLMs) poses significant risks, as models are likely to gain knowledge of sensitive topics such as bio-security, as well the ability to replicate copyrighted works. Methods designed to remove such knowledge must do so from all prompt directions, in a multi-lingual capacity and without degrading general model performance. To this end, we introduce the targeted angular reversal (TARS) method of knowledge removal from LLMs. The TARS method firstly leverages the LLM in combination with a detailed prompt to aggregate information about a selected concept in the internal representation space of the LLM. It then refines this approximate concept vector to trigger the concept token with high probability, by perturbing the approximate concept vector with noise and transforming it into token scores with the language model head. The feedforward weight vectors in the LLM which operate directly on the internal representation space, and have the highest cosine similarity with this targeting vector, are then replaced by a reversed targeting vector, thus limiting the ability of the concept to propagate through the model. The modularity of the TARS method allows for a sequential removal of concepts from Llama 3.1 8B, such as the famous literary detective Sherlock Holmes, and the planet Saturn. It is demonstrated that the probability of triggering target concepts can be reduced to 0.00 with as few as 1 TARS edit, whilst simultaneously removing the knowledge bi-directionally. Moreover, knowledge is shown to be removed across all languages despite only being targeted in English. Importantly, TARS has minimal impact on the general model capabilities, as after removing 5 diverse concepts in a modular fashion, there is minimal KL divergence in the next token probabilities of the LLM on large corpora of Wikipedia text (median of 0.0015).
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。