提出新防御框架GRACE，解决大模型对抗攻击中的隐式伪装问题。
AdversariaL attacK sAfety aLIgnment(ALKALI): Safeguarding LLMs through GRACE: Geometric Representation-Aware Contrastive Enhancement- Introducing Adversarial Vulnerability Quality Index (AVQI)
- 通过几何感知对比增强，让安全与危险输出在潜在空间中分离。
- 在9000个攻击样本上测试，最高降低39%攻击成功率。
- 引入新指标AVQI，可量化模型内部安全对齐的失效程度。
大语言模型面临的对抗威胁正以超过现有防御速度的速率增长。我们揭示了对齐中的关键几何盲区：对抗性提示利用潜在伪装，在接近安全表示流形的同时编码不安全意图，从而规避如直接偏好优化（DPO）等表层防御机制。为此，我们提出ALKALI——首个严格构建的对抗基准，涵盖9000个提示，分属三大类、六子类和十五种攻击类型。对21个主流大模型的评估显示，无论开源还是闭源模型，攻击成功率（ASR）均极高，暴露了一种名为‘潜藏伪装’的结构性盲点：对抗生成内容在潜在空间中模仿安全内容的几何特征。为缓解此问题，我们提出GRACE——一种融合偏好学习与潜在空间正则化的对齐框架。GRACE施加双重约束：安全与对抗生成内容在潜在空间中实现分离；不安全行为间保持对抗内聚性。该方法基于逐层池化嵌入，并由学习到的注意力分布引导，重塑模型内部几何结构，无需修改基础模型，最高可降低39%的攻击成功率。此外，我们提出AVQI——一种几何感知度量，通过聚类分离度与紧凑性量化潜在对齐失败。AVQI能识别不安全输出是否模仿安全输出的几何特征，为模型内部安全编码提供可解释视角。代码已公开于 https://anonymous.4open.science/r/alkali-B416/README.md。
原文摘要 · Abstract (English)
Adversarial threats against LLMs are escalating faster than current defenses can adapt. We expose a critical geometric blind spot in alignment: adversarial prompts exploit latent camouflage, embedding perilously close to the safe representation manifold while encoding unsafe intent thereby evading surface level defenses like Direct Preference Optimization (DPO), which remain blind to the latent geometry. We introduce ALKALI, the first rigorously curated adversarial benchmark and the most comprehensive to date spanning 9,000 prompts across three macro categories, six subtypes, and fifteen attack families. Evaluation of 21 leading LLMs reveals alarmingly high Attack Success Rates (ASRs) across both open and closed source models, exposing an underlying vulnerability we term latent camouflage, a structural blind spot where adversarial completions mimic the latent geometry of safe ones. To mitigate this vulnerability, we introduce GRACE - Geometric Representation Aware Contrastive Enhancement, an alignment framework coupling preference learning with latent space regularization. GRACE enforces two constraints: latent separation between safe and adversarial completions, and adversarial cohesion among unsafe and jailbreak behaviors. These operate over layerwise pooled embeddings guided by a learned attention profile, reshaping internal geometry without modifying the base model, and achieve up to 39% ASR reduction. Moreover, we introduce AVQI, a geometry aware metric that quantifies latent alignment failure via cluster separation and compactness. AVQI reveals when unsafe completions mimic the geometry of safe ones, offering a principled lens into how models internally encode safety. We make the code publicly available at https://anonymous.4open.science/r/alkali-B416/README.md.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。