通过模型权重追溯并逆转大模型中的恶意知识修改。
Tracing and Reversing Edits in LLMs
- 仅凭修改后的权重定位被编辑的实体，准确率达99%。
- 无需训练即可逆转94%的编辑，恢复原始输出分布。
- 适合关注模型安全与可解释性的研究者使用。
知识编辑方法（KEs）是更新大语言模型（LLMs）事实内容的一种低成本方式，但存在双重用途风险。尽管它们有助于修正过时或错误信息，却可能被恶意利用植入虚假信息或偏见。为防范此类恶意操纵，亟需可靠的技术来检测、解析和缓解恶意编辑。为此，我们提出追溯与逆转编辑的任务。我们提出一种新方法，仅基于修改后的权重即可推断被编辑的实体，无需访问编辑提示或其他语义相似提示，准确率高达99%。此外，我们提出一种无需训练的有效逆转方法，可逆转高达94%的编辑，并在不获取任何编辑信息的情况下恢复原始模型输出分布。该方法还可用于区分已编辑与未编辑的权重。研究结果表明，仅通过权重即可实现编辑的追溯与逆转，为保护大模型免受对抗性操纵开辟了新方向。
原文摘要 · Abstract (English)
Knowledge editing methods (KEs) are a cost-effective way to update the factual content of large language models (LLMs), but they pose a dual-use risk. While KEs are beneficial for updating outdated or incorrect information, they can be exploited maliciously to implant misinformation or bias. In order to defend against these types of malicious manipulation, we need robust techniques that can reliably detect, interpret, and mitigate malicious edits. To that end, we introduce the tasks of tracing and reversing edits. We propose a novel method to infer the edited object entity, solely based on the modified weights, without access to the editing prompt or any other semantically similar prompts, with up to 99% accuracy. Further, we propose an effective and training-free method for reversing edits. Our method reverses up to 94% of the edits, and helps regain the original model's output distribution without access to any information about the edit. This method can further be repurposed to distinguish between edited and unedited weights. Our findings highlight the feasibility of tracing and reversing edits based on the edited weights, opening a new research direction for safeguarding LLMs against adversarial manipulations.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。