发现大模型安全行为由多个正交方向共同控制，揭示了对齐漏洞的新机制。
The Hidden Dimensions of LLM Alignment: A Multi-Dimensional Analysis of Orthogonal Safety Directions
- 通过分析微调过程中的表示变化，发现安全拒绝行为由主方向与多个次要方向共同决定。
- 次要方向对应虚构叙事、角色扮演等可解释特征，影响主方向的激活强度。
- 移除特定触发词可绕过安全机制，为理解对齐脆弱性提供新视角。
大型语言模型的安全对齐行为（如拒绝有害请求）可在激活空间中用线性方向表示。以往研究将其建模为单一方向，限制了对安全机制的深入理解。本文研究 Llama 3 8B 在拒绝越狱攻击时的微调过程，发现安全行为由多维方向联合控制。首先，识别出主导方向决定拒绝行为，而多个较小方向分别表征虚构叙事、角色扮演等可解释特征。其次，量化不同方向对主方向的促进或抑制作用，揭示次级方向在塑造拒绝表征中的关键作用。最后，实验表明移除有害查询中的特定触发词可削弱这些方向，从而绕过已学习的安全能力，从多维视角揭示了安全对齐的潜在漏洞。代码与数据集已公开于 https://github.com/BMPixel/safety-residual-space。
原文摘要 · Abstract (English)
Large Language Models' safety-aligned behaviors, such as refusing harmful queries, can be represented by linear directions in activation space. Previous research modeled safety behavior with a single direction, limiting mechanistic understanding to an isolated safety feature. In this work, we discover that safety-aligned behavior is jointly controlled by multi-dimensional directions. Namely, we study the vector space of representation shifts during safety fine-tuning on Llama 3 8B for refusing jailbreaks. By studying orthogonal directions in the space, we first find that a dominant direction governs the model's refusal behavior, while multiple smaller directions represent distinct and interpretable features like hypothetical narrative and role-playing. We then measure how different directions promote or suppress the dominant direction, showing the important role of secondary directions in shaping the model's refusal representation. Finally, we demonstrate that removing certain trigger tokens in harmful queries can mitigate these directions to bypass the learned safety capability, providing new insights on understanding safety alignment vulnerability from a multi-dimensional perspective. Code and artifacts are available at https://github.com/BMPixel/safety-residual-space.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。