通过识别关键潜在维度,提升大模型抗越狱攻击能力。
Latent-space adversarial training with post-aware calibration for defending large language models against jailbreak attacks
- 在潜在空间中定位安全敏感维度,针对性构建拒答攻击
- 五类伪装攻击下防御效果优于现有方法,兼顾安全性与可用性
- 适合关注大模型安全防护的研究者和开发者
保障大语言模型(LLMs)的安全对齐是其在现实应用中部署的关键要求。尽管取得进展,LLMs仍易受越狱攻击影响,此类攻击利用系统漏洞绕过安全机制,生成有害或不当内容。现有基于对抗训练的防御方法常出现过度防御问题,导致模型错误拒绝正常查询,严重影响实用性。为此,本文提出LATPC框架:通过对比有害与良性输入,动态识别安全敏感的潜在维度,实现针对伪装型越狱攻击的精准防御。推理阶段采用轻量级嵌入级校准机制,显著降低过度防御,计算开销极低。在五类伪装型越狱攻击上的实验表明,该方法在安全与实用性间实现更优平衡。分析进一步验证了安全敏感维度在构建鲁棒防御中的有效性。
原文摘要 · Abstract (English)
Ensuring safety alignment is a critical requirement for large language models (LLMs), particularly given increasing deployment in real-world applications. Despite considerable advancements, LLMs remain susceptible to jailbreak attacks, which exploit system vulnerabilities to circumvent safety measures and elicit harmful or inappropriate outputs. Furthermore, while adversarial training-based defense methods have shown promise, a prevalent issue is the unintended over-defense behavior, wherein models excessively reject benign queries, significantly undermining their practical utility. To address these limitations, we introduce LATPC, a Latent-space Adversarial Training with Post-aware Calibration framework. LATPC dynamically identifies safety-critical latent dimensions by contrasting harmful and benign inputs, enabling the adaptive construction of targeted refusal feature removal attacks. This mechanism allows adversarial training to concentrate on real-world jailbreak tactics that disguise harmful queries as benign ones. During inference, LATPC employs an efficient embedding-level calibration mechanism to minimize over-defense behaviors with negligible computational overhead. Experimental results across five types of disguise-based jailbreak attacks demonstrate that LATPC achieves a superior balance between safety and utility compared to existing defense frameworks. Further analysis demonstrates the effectiveness of leveraging safety-critical dimensions in developing robust defense methods against jailbreak attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。