提出神经屏障函数，主动防御多轮越狱攻击，保障对话全程安全。
Steering Dialogue Dynamics for Robustness against Multi-turn Jailbreaking Attacks
- 用状态空间建模对话，引入神经屏障函数实时检测有害请求。
- 在多轮对话中实现每轮不变的安全性，有效防止上下文漂移。
- 适合关注大模型安全的开发者与研究者，尤其对抗复杂越狱场景。
大型语言模型易受越狱攻击，攻击者通过精心设计的提示诱导模型生成有害内容。现有防御方法虽能应对单轮攻击，但在多轮越狱中因依赖上下文而失效，攻击者可逐步引导模型偏离安全行为。为此，本文提出基于安全控制理论的安全引导框架，将对话建模为状态空间系统，并引入新型神经屏障函数（NBF），主动识别由上下文演变产生的有害查询。该方法通过学习兼顾对抗性提示的安全预测器，在每一轮对话中确保安全性不变，预防潜在的越狱上下文漂移。在多个大模型上的实验表明，基于NBF的安全引导显著优于安全对齐、提示引导和轻量级防护基线，在抵御多轮越狱攻击的同时，更好平衡了安全性、帮助性与过度拒绝问题。
原文摘要 · Abstract (English)
Large language models (LLMs) are shown to be vulnerable to jailbreaking attacks where adversarial prompts are designed to elicit harmful responses. While existing defenses effectively mitigate single-turn attacks by detecting and filtering unsafe inputs, they fail against multi-turn jailbreaks that exploit contextual drift over multiple interactions, gradually leading LLMs away from safe behavior. To address this challenge, we propose a safety steering framework grounded in safe control theory, ensuring invariant safety in multi-turn dialogues. Our approach models the dialogue with LLMs using state-space representations and introduces a novel neural barrier function (NBF) to detect and filter harmful queries emerging from evolving contexts proactively. Our method achieves invariant safety at each turn of dialogue by learning a safety predictor that accounts for adversarial queries, preventing potential context drift toward jailbreaks. Extensive experiments under multiple LLMs show that our NBF-based safety steering outperforms safety alignment, prompt-based steering and lightweight LLM guardrails baselines, offering stronger defenses against multi-turn jailbreaks while maintaining a better trade-off among safety, helpfulness and over-refusal. Check out the website here https://sites.google.com/view/llm-nbf/home.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。