用轻量级过滤器拦截恶意后缀，保护大模型免受越狱攻击。
Adversarial Suffix Filtering: a Defense Pipeline for LLMs
- 作为输入预处理器，检测并清除恶意构造的后缀。
- 在黑盒白盒攻击下将攻击成功率降至4%以下。
- 不增加计算开销，适合广泛部署于各类大模型。
大型语言模型（LLMs）正越来越多地应用于自主系统和面向公众的环境，但其仍易受越狱漏洞威胁，损害安全与可信度。对抗性后缀是当前最先进的越狱方法，在黑盒设置中也频繁成功。现有防御手段受限于模型内部结构访问，显著增加内存与计算开销，或可被简单提示工程绕过。我们提出一种名为对抗性后缀过滤（ASF）的轻量级、模型无关的防御管道，可作为输入预处理器对提示中的对抗性后缀进行检测与过滤，有效中和恶意注入。实验表明，ASF在黑盒与白盒攻击场景下均具备全面防御能力，将主流对抗性后缀生成方法的攻击成功率降至4%以下，且对正常任务性能影响极小。
原文摘要 · Abstract (English)
Large Language Models (LLMs) are increasingly embedded in autonomous systems and public-facing environments, yet they remain susceptible to jailbreak vulnerabilities that may undermine their security and trustworthiness. Adversarial suffixes are considered to be the current state-of-the-art jailbreak, consistently outperforming simpler methods and frequently succeeding even in black-box settings. Existing defenses rely on access to the internal architecture of models limiting diverse deployment, increase memory and computation footprints dramatically, or can be bypassed with simple prompt engineering methods. We introduce $\textbf{Adversarial Suffix Filtering}$ (ASF), a lightweight novel model-agnostic defensive pipeline designed to protect LLMs against adversarial suffix attacks. ASF functions as an input preprocessor and sanitizer that detects and filters adversarially crafted suffixes in prompts, effectively neutralizing malicious injections. We demonstrate that ASF provides comprehensive defense capabilities across both black-box and white-box attack settings, reducing the attack efficacy of state-of-the-art adversarial suffix generation methods to below 4%, while only minimally affecting the target model's capabilities in non-adversarial scenarios.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。