通过修复模型特定层的漏洞，有效防御越狱攻击。
Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense
- 识别易产生有害响应的模型层，用对抗数据增强暴露其弱点。
- 在不损害正常问答能力前提下，降低越狱攻击成功率至37%以下。
- 适合关注大模型安全防护的研究者与工业应用开发者。
大型语言模型（LLMs）在聊天助手、代码生成等场景中广泛应用，其行为对齐安全与伦理标准愈发重要。然而，越狱攻击可通过利用漏洞诱导模型输出有害内容，严重威胁安全性。本文提出Layer-AdvPatcher，一种基于去学习策略的防御方法，通过自增强数据集针对性修复模型特定层。核心洞察是：某些层在面对有害提示时倾向于生成肯定性令牌。我们识别这些层，并通过对抗暴露生成更多有害数据，以揭示其内在脆弱性；随后实施“去学习”操作，削弱肯定性令牌的影响，从而显著降低越狱风险，同时保持对良性查询的响应质量。我们在两个模型、四个基准数据集及多种先进越狱攻击上进行实验，结果表明，该框架在不牺牲良性任务性能的前提下，将有害性与攻击成功率显著降低，优于现有防御方法。代码已公开于 https://github.com/oyy2000/LayerAdvPatcher。
原文摘要 · Abstract (English)
As large language models (LLMs) are increasingly deployed in diverse applications, including chatbot assistants and code generation, aligning their behavior with safety and ethical standards has become paramount. However, jailbreak attacks, which exploit vulnerabilities to elicit unintended or harmful outputs, threaten LLMs' safety significantly. In this paper, we introduce Layer-AdvPatcher, a novel methodology designed to defend against jailbreak attacks by utilizing an unlearning strategy to patch specific layers within LLMs through self-augmented datasets. Our insight is that certain layer(s), tend to produce affirmative tokens when faced with harmful prompts. By identifying these layers and adversarially exposing them to generate more harmful data, one can understand their inherent and diverse vulnerabilities to attacks. With these exposures, we then "unlearn" these issues, reducing the impact of affirmative tokens and hence minimizing jailbreak risks while keeping the model's responses to safe queries intact. We conduct extensive experiments on two models, four benchmark datasets, and multiple state-of-the-art jailbreak attacks to demonstrate the efficacy of our approach. Results indicate that our framework reduces the harmfulness and attack success rate of jailbreak attacks without compromising utility for benign queries compared to recent defense methods. Our code is publicly available at: https://github.com/oyy2000/LayerAdvPatcher
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。