通过恶意分词绕过大模型安全限制，揭示了新攻击方式。
Adversarial Tokenization
- 用不同分词方式伪装恶意请求，让模型忽略内容危害性。
- 在3个主流大模型上验证成功，攻击成功率与现有方法相当。
- 适合研究模型安全与对抗攻击的学者关注。
当前大语言模型仅使用单一分词方式处理字符串，忽略了训练和推理过程中指数级存在的其他合法分词方案。例如，'penguin'的标准Llama3分词为[p, egin]，但[peng, uin]同样是有效分词。本文发现，尽管模型仅在一种分词下训练，仍能理解其他分词的语义，这引发对模型安全性的新担忧。核心问题：能否通过恶意分词使明显有害的请求规避安全与对齐机制？我们证明，这种对抗性分词不仅是一种被忽视的有效攻击路径，且无需修改原始文本即可达到与现有顶尖攻击方法相当的效果。我们在三个前沿大模型及对抗数据集上实证验证了该漏洞，揭示了子词模型中一个此前未知的安全缺陷。
原文摘要 · Abstract (English)
Current LLM pipelines account for only one possible tokenization for a given string, ignoring exponentially many alternative tokenizations during training and inference. For example, the standard Llama3 tokenization of penguin is [p,enguin], yet [peng,uin] is another perfectly valid alternative. In this paper, we show that despite LLMs being trained solely on one tokenization, they still retain semantic understanding of other tokenizations, raising questions about their implications in LLM safety. Put succinctly, we answer the following question: can we adversarially tokenize an obviously malicious string to evade safety and alignment restrictions? We show that not only is adversarial tokenization an effective yet previously neglected axis of attack, but it is also competitive against existing state-of-the-art adversarial approaches without changing the text of the harmful request. We empirically validate this exploit across three state-of-the-art LLMs and adversarial datasets, revealing a previously unknown vulnerability in subword models.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。