用单个标记实时检测大模型越狱攻击，轻量高效。
STShield: Single-Token Sentinel for Real-Time Jailbreak Detection in Large Language Models
- 在输出序列加二进制安全标记，利用模型自身对齐能力判断是否越狱。
- 对抗训练结合正常提示微调，检测准确率高且不影响合法请求性能。
- 计算开销极小，适合实际部署，尤其适合对响应速度要求高的场景。
大型语言模型（LLMs）正面临越狱攻击的威胁，此类攻击可绕过其安全机制。现有防御方法或易被适应性攻击突破，或需计算成本高昂的辅助模型。本文提出STShield，一种轻量级实时越狱判断框架。该框架引入新型单令牌哨兵机制，在模型输出序列末尾附加一个二进制安全指示符，利用大模型自身的对齐能力实现检测。通过在正常提示上进行监督微调，并结合嵌入空间扰动的对抗训练，STShield在保持模型可用性的同时实现了强健的检测能力。大量实验表明，该方法能有效抵御多种越狱攻击，同时在合法查询上的性能不受影响。相比现有方法，STShield在防御效果上更优且计算开销极低，是面向真实场景部署的大模型安全解决方案。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have become increasingly vulnerable to jailbreak attacks that circumvent their safety mechanisms. While existing defense methods either suffer from adaptive attacks or require computationally expensive auxiliary models, we present STShield, a lightweight framework for real-time jailbroken judgement. STShield introduces a novel single-token sentinel mechanism that appends a binary safety indicator to the model's response sequence, leveraging the LLM's own alignment capabilities for detection. Our framework combines supervised fine-tuning on normal prompts with adversarial training using embedding-space perturbations, achieving robust detection while preserving model utility. Extensive experiments demonstrate that STShield successfully defends against various jailbreak attacks, while maintaining the model's performance on legitimate queries. Compared to existing approaches, STShield achieves superior defense performance with minimal computational overhead, making it a practical solution for real-world LLM deployment.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。