一次前向传播即可检测大模型越狱攻击，高效又准确。
Single-pass Detection of Jailbreaking Input in Large Language Models
- 利用输出logits信息判断输入是否为越狱攻击。
- 在开源模型上检测准确率高，误判率低。
- 无需完整logit访问，适用于GPT-3.5/4等闭源模型。
防御对齐的大语言模型（LLMs）免受越狱攻击是一项挑战，现有方法通常需要多次请求甚至调用辅助LLM，计算开销大。本文提出单次前向传播检测方法SPD，利用输出logits中的信息预测输出是否有害，从而实现一次前向传播完成防御。SPD不仅在开源模型上有效检测越狱攻击，还能显著降低无害输入的误判率。此外，即使在无法获取完整logit的情况下，该方法在GPT-3.5和GPT-4上依然保持有效性。我们认为该方法为高效防护大模型对抗攻击提供了可行路径。
原文摘要 · Abstract (English)
Defending aligned Large Language Models (LLMs) against jailbreaking attacks is a challenging problem, with existing approaches requiring multiple requests or even queries to auxiliary LLMs, making them computationally heavy. Instead, we focus on detecting jailbreaking input in a single forward pass. Our method, called Single Pass Detection SPD, leverages the information carried by the logits to predict whether the output sentence will be harmful. This allows us to defend in just one forward pass. SPD can not only detect attacks effectively on open-source models, but also minimizes the misclassification of harmless inputs. Furthermore, we show that SPD remains effective even without complete logit access in GPT-3.5 and GPT-4. We believe that our proposed method offers a promising approach to efficiently safeguard LLMs against adversarial attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。