提出双目标编辑框架，解决大模型后门攻击中的安全退化问题。
DualEdit: Mitigating Safety Fallback in LLM Backdoor Editing via Affirmation-Refusal Regulation
- 通过同时鼓励肯定性输出和抑制拒绝性输出来稳定攻击效果。
- 实验显示攻击成功率提升10%，安全退化率降低11%。
- 适合关注大模型安全防御与攻击机制的研究者阅读。
对齐安全的大语言模型仍易受后门攻击。现有基于模型编辑的攻击方法通过修改少量参数，将触发词映射到攻击者期望的行为，但我们在实验中发现，这些方法在安全对齐下往往不稳定：模型初始生成肯定内容，后续却转为拒绝生成。我们称此现象为安全退化。为此，我们提出DualEdit，一种双目标模型编辑框架，同时促进肯定性标记并抑制拒绝性标记。DualEdit进一步通过两项互补技术应对两个关键挑战：（1）动态损失加权，利用预编辑模型校准两项目标相对规模，稳定优化过程；（2）价值锚定，聚类代表性注意力值向量形成紧凑锚点，降低来自过度多样标记集的冲突，提升泛化能力。在对齐安全的大语言模型上实验表明，DualEdit相比基线攻击成功率提升10%，安全退化率降低11%。
原文摘要 · Abstract (English)
Safety-aligned large language models (LLMs) remain vulnerable to backdoor attacks. Recent model editing-based approaches enable efficient backdoor injection by directly modifying a small set of parameters to map triggers to attacker-desired behaviors. However, we find that existing editing-based attacks are often unstable under safety alignment: the edited model may start with an affirmative prefix but later revert to refusals during generation. We term this phenomenon safety fallback. To mitigate it, we propose DualEdit, a dual-objective model editing framework that simultaneously promotes affirmative tokens and suppresses refusal tokens. DualEdit further addresses two key challenges, objective imbalance and refusal diversity, via two complementary techniques: (1) dynamic loss weighting, which calibrates the relative scales of the two objectives using the pre-edited model to stabilize optimization, and (2) value anchoring, which clusters representative attention value vectors to form compact anchors, reducing conflicts from overly diverse token sets and improving generalization. Experiments on safety-aligned LLMs show that DualEdit improves attack success by 10% and reduces safety fallback rate by 11% over baselines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。