提出Virus攻击，绕过安全过滤器实现高效有害微调。
Virus: Harmful Fine-tuning Attack for Large Language Models Bypassing Guardrail Moderation
- 设计病毒式攻击，微调有害数据以避开安全检测
- 攻击数据100%逃过过滤器，且攻击效果更优
- 警示仅靠过滤器无法解决大模型安全根本问题
近期研究显示，大型语言模型（LLMs）易受有害微调攻击——在少量有害样本上微调后，模型会丧失安全对齐能力。为降低风险，通常采用防护墙（guardrail）在微调前过滤有害样本。本文通过设计一种新型红队测试方法，揭示单纯依赖防护墙进行数据过滤并不可靠。所提出的攻击方法Virus可通过轻微修改有害数据，轻松绕过防护墙检测。实验表明，经Virus优化的有害数据在高达100%的泄漏率下仍无法被防护墙识别，同时具备更优的攻击性能。本文核心观点是：将防护墙视为应对有害微调攻击的救命稻草是鲁莽的，因其无法解决预训练模型固有的安全缺陷。代码已开源：https://github.com/git-disl/Virus。
原文摘要 · Abstract (English)
Recent research shows that Large Language Models (LLMs) are vulnerable to harmful fine-tuning attacks -- models lose their safety alignment ability after fine-tuning on a few harmful samples. For risk mitigation, a guardrail is typically used to filter out harmful samples before fine-tuning. By designing a new red-teaming method, we in this paper show that purely relying on the moderation guardrail for data filtration is not reliable. Our proposed attack method, dubbed Virus, easily bypasses the guardrail moderation by slightly modifying the harmful data. Experimental results show that the harmful data optimized by Virus is not detectable by the guardrail with up to 100\% leakage ratio, and can simultaneously achieve superior attack performance. Finally, the key message we want to convey through this paper is that: \textbf{it is reckless to consider guardrail moderation as a clutch at straws towards harmful fine-tuning attack}, as it cannot solve the inherent safety issue of the pre-trained LLMs. Our code is available at https://github.com/git-disl/Virus
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。