代码混杂攻击让大模型安全机制失效，成功率从9%飙升至69%
Attributional Safety Failures in Large Language Models under Code-Mixed Perturbations
- 用语言混杂伪装绕过安全检测，使模型注意力偏离危险词
- 真实社交数据中攻击成功率超90%，非西方语境更严重
- 提出轻量翻译修复法，恢复约80%安全性能，适合多语言场景
尽管大语言模型在英语下表现出稳健的安全对齐，我们发现了一个被忽视的灾难性弱点：在代码混杂扰动下出现归属性崩溃。对开源模型的系统评估显示，语言混杂——即单次对话中混合多种语言——可导致安全防护机制大幅失效。攻击成功率（ASR）从纯英语下的良性9%跃升至代码混杂输入时的69%，在阿拉伯语和印地语等非西方语境中甚至超过90%。该现象不仅存在于受控合成数据集，也在真实社交媒体数据中重现，对数十亿用户构成严重风险。为解释成因，我们引入显著性漂移归因（SDA）框架，揭示在代码混杂条件下，模型内部注意力会偏离安全关键标记（如'暴力'或'腐败'），从而丧失对恶意意图的识别能力。最后，我们提出一种基于轻量级翻译的恢复策略，可恢复约80%因代码混杂损失的安全性，为实现更公平、鲁棒的大模型安全提供可行路径。
原文摘要 · Abstract (English)
While LLMs appear robustly safety-aligned in English, we uncover a catastrophic, overlooked weakness: attributional collapse under code-mixed perturbations. Our systematic evaluation of open models shows that the linguistic camouflage of code-mixing -- ``blending languages within a single conversation'' -- can cause safety guardrails to fail dramatically. Attack success rates (ASR) spike from a benign 9\% in monolingual English to 69\% under code-mixed inputs, with rates exceeding 90\% in non-Western contexts such as Arabic and Hindi. These effects hold not only on controlled synthetic datasets but also on real-world social media traces, revealing a serious risk for billions of users. To explain why this happens, we introduce saliency drift attribution (SDA), an interpretability framework that shows how, under code-mixing, the model's internal attention drifts away from safety-critical tokens (e.g., ``violence'' or ``corruption''), effectively blinding it to harmful intent. Finally, we propose a lightweight translation-based restoration strategy that recovers roughly 80\% of the safety lost to code-mixing, offering a practical path toward more equitable and robust LLM safety.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。