arXiv:2502.11647cs.CRcs.AI2025-02ACL被引 13

用精准参数修改防御大模型越狱攻击,不伤正常功能

DELMAN: Dynamic Defense Against Large Language Model Jailbreaking with Model Editing

  • 直接编辑少量关键参数,动态阻断越狱行为
  • 在保持模型通用能力的同时,有效抵御越狱攻击
  • 适合部署后持续防护,对安全性和效率兼顾

大型语言模型广泛用于决策,但面临越狱攻击威胁——恶意用户诱导模型绕过安全限制。现有防御方法如安全微调和模型编辑,或需大量参数改动,或精度不足,导致通用任务性能下降,难以用于部署后的安全对齐。为此,我们提出 DELMAN(动态防御越狱的模型编辑),通过直接更新少量相关参数,精准中和有害行为,同时保留模型实用性。为避免良性输入被误判为危险,引入 KL 散度正则化,确保修改后模型在处理正常请求时与原模型一致。实验表明,DELMAN 在抵御越狱攻击的同时有效保持模型通用能力,能无缝适应新攻击实例,提供一种实用高效的部署后保护方案。

原文摘要 · Abstract (English)

Large Language Models (LLMs) are widely applied in decision making, but their deployment is threatened by jailbreak attacks, where adversarial users manipulate model behavior to bypass safety measures. Existing defense mechanisms, such as safety fine-tuning and model editing, either require extensive parameter modifications or lack precision, leading to performance degradation on general tasks, which is unsuitable to post-deployment safety alignment. To address these challenges, we propose DELMAN (Dynamic Editing for LLMs JAilbreak DefeNse), a novel approach leveraging direct model editing for precise, dynamic protection against jailbreak attacks. DELMAN directly updates a minimal set of relevant parameters to neutralize harmful behaviors while preserving the model's utility. To avoid triggering a safe response in benign context, we incorporate KL-divergence regularization to ensure the updated model remains consistent with the original model when processing benign queries. Experimental results demonstrate that DELMAN outperforms baseline methods in mitigating jailbreak attacks while preserving the model's utility, and adapts seamlessly to new attack instances, providing a practical and efficient solution for post-deployment model protection.

大模型安全越狱防御模型编辑

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。