让大模型对同义提问更鲁棒，提升真实场景可靠性
Same Question, Different Words: A Latent Adversarial Framework for Prompt Robustness
- 用对抗性扰动在隐空间生成语义不变的改写提示
- 在RobustAlpaca上使最差情况胜率提升0.5%-4%
- 无需调参或复杂推理，适配多种大模型
大语言模型对提示词的语义等价改写（即同义提问）敏感度低，是确保其可靠行为与实际部署的关键。然而现有模型在面对语义相同但表述不同的提示时性能显著下降，现有解决方案或依赖试错式提示工程，或需计算开销大的推理时算法。本文基于最差情况提示在嵌入空间中存在偏移的洞察，提出潜空间对抗改写（LAP）框架：内层循环训练可学习的扰动作为“隐空间连续改写”，通过拉格朗日约束保持语义一致；外层循环在这些扰动上优化语言模型参数。大量实验表明，LAP在多个大模型架构上均有效，在RobustAlpaca基准上相比原始监督微调，最差情况胜率提升0.5%至4%。
原文摘要 · Abstract (English)
Insensitivity to semantically-preserving variations of prompts (paraphrases) is crucial for reliable behavior and real-world deployment of large language models. However, language models exhibit significant performance degradation when faced with semantically equivalent but differently phrased prompts, and existing solutions either depend on trial-and-error prompt engineering or require computationally expensive inference-time algorithms. In this study, built on the key insight that worst-case prompts exhibit a drift in embedding space, we present Latent Adversarial Paraphrasing (LAP), a dual-loop adversarial framework: the inner loop trains a learnable perturbation to serve as a "latent continuous paraphrase" while preserving semantics through Lagrangian regulation, and the outer loop optimizes the language model parameters on these perturbations. We conduct extensive experiments to demonstrate the effectiveness of LAP across multiple LLM architectures on the RobustAlpaca benchmark with a 0.5%-4% absolution improvement on worst-case win-rate compared with vanilla supervised fine-tuning.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。