通过分散拒绝信号，让大模型更难被恶意攻击破解。
An Embarrassingly Simple Defense Against LLM Abliteration Attacks
- 将拒绝理由拆解到多个词位置，避免单一信号被攻击
- 攻击后拒绝率下降不超过10%，远优于基准模型的70-80%下降
- 适合关注模型安全、对抗攻击防护的研究者与开发者
大型语言模型通常通过安全微调来拒绝有害指令。最近一种称为‘抹除攻击’（abliteration）的方法，识别并压制最能引发拒绝行为的单一潜在方向，从而诱导模型生成有害内容。本文提出一种防御策略，从根本上改变模型表达拒绝的方式：构建一个扩展拒绝数据集，其中对有害提示的回复在拒绝前提供详细理由，将拒绝信号分布到多个词元位置。在 Llama-2-7B-Chat 和 Qwen2.5-Instruct（1.5B 与 3B 参数）上使用该数据集进行微调，使模型在遭受抹除攻击时仍保持高拒绝率——拒绝率最多下降10%，而基线模型下降达70-80%。全面评估显示，扩展拒绝微调有效中和了抹除攻击，同时维持模型通用性能，并增强多种对齐场景下的鲁棒性。
原文摘要 · Abstract (English)
Large language models (LLMs) are typically aligned to refuse harmful instructions through safety fine-tuning. A recent attack, termed abliteration, identifies and suppresses the single latent direction most responsible for refusal behavior, thereby enabling models to generate harmful content. We propose a defense that fundamentally alters how models express refusal. We construct an extended-refusal dataset in which responses to harmful prompts provide detailed justifications before refusing, distributing the refusal signal across multiple token positions. Fine-tuning Llama-2-7B-Chat and Qwen2.5-Instruct (1.5B and 3B parameters) on this dataset yields models that maintain high refusal rates under abliteration: refusal rates drop by at most 10%, compared to 70-80% drops in baseline models. Comprehensive evaluations of safety and utility demonstrate that extended-refusal fine-tuning effectively neutralizes abliteration attacks while preserving general model performance and enhancing robustness across multiple alignment scenarios.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。