让大模型自动识别并防御越狱攻击，还能不误伤正常请求。
AdaSteer: Your Aligned LLM is Inherently an Adaptive Jailbreak Defender
- 根据输入特征动态调整防御强度，不再用固定参数。
- 在多个模型上对越狱攻击防御率超基线方法，且正常输入误判极少。
- 适合关注模型安全、希望零成本部署防御的开发者使用。
尽管已有大量安全对齐研究，大语言模型仍易受越狱攻击。激活引导是一种无需训练的防御方法，但依赖固定引导系数，导致防护效果不佳并增加对良性输入的误拒。为此，我们提出AdaSteer，一种自适应激活引导方法，可根据输入特性动态调整模型行为。我们发现两个关键规律：拒绝律（R-Law）表明，与拒绝方向相反的越狱输入需更强引导；危害性律（H-Law）可区分恶意与良性输入。AdaSteer沿拒绝方向（RD）和危害性方向（HD）引导输入表征，通过逻辑回归学习自适应系数，实现强越狱防御同时保留良性输入处理能力。在LLaMA-3.1、Gemma-2和Qwen2.5上的实验显示，AdaSteer在多种越狱攻击下优于基线方法，且对模型实用性影响极小。结果表明，可解释的模型内部机制可用于实时、灵活的安全保障。
原文摘要 · Abstract (English)
Despite extensive efforts in safety alignment, large language models (LLMs) remain vulnerable to jailbreak attacks. Activation steering offers a training-free defense method but relies on fixed steering coefficients, resulting in suboptimal protection and increased false rejections of benign inputs. To address this, we propose AdaSteer, an adaptive activation steering method that dynamically adjusts model behavior based on input characteristics. We identify two key properties: Rejection Law (R-Law), which shows that stronger steering is needed for jailbreak inputs opposing the rejection direction, and Harmfulness Law (H-Law), which differentiates adversarial and benign inputs. AdaSteer steers input representations along both the Rejection Direction (RD) and Harmfulness Direction (HD), with adaptive coefficients learned via logistic regression, ensuring robust jailbreak defense while preserving benign input handling. Experiments on LLaMA-3.1, Gemma-2, and Qwen2.5 show that AdaSteer outperforms baseline methods across multiple jailbreak attacks with minimal impact on utility. Our results highlight the potential of interpretable model internals for real-time, flexible safety enforcement in LLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。