发现大模型安全对隐层扰动不鲁棒，提出新方法增强防御能力。
Probing the Robustness of Large Language Models Safety to Latent Perturbations
- 通过探测隐层激活敏感性，识别安全漏洞方向。
- 构建激活引导攻击（ASA），成功绕过安全防护。
- 提出分层对抗补丁训练，提升鲁棒性且不损失通用能力。
安全对齐是构建可靠通用人工智能的关键要求。尽管安全对齐取得显著进展，我们仍发现微小的隐层变化可能引发对齐模型产生不安全响应。这源于现有对齐方法的浅层特性：仅关注表面拒绝行为，未充分改变内部表征。因此，隐藏激活的微小偏移可重新触发潜藏在隐空间中的有害行为。为探究安全对齐对隐层扰动的鲁棒性，我们引入一种探测方法，通过测量原响应的负对数似然来量化隐层局部敏感性，作为诊断工具识别脆弱方向。基于该信号，我们构造出有效的越狱路径，提出激活引导攻击（ASA）。更重要的是，这些发现为提升对齐鲁棒性提供了原则性基础。为此，我们提出分层对抗补丁训练（LAPT），一种在训练中向隐藏表示注入受控扰动的微调策略。实验结果表明，LAPT能增强对齐鲁棒性，且不损害模型通用能力。研究揭示了当前对齐范式的根本缺陷，呼吁超越表面行为监督的表征级训练策略。代码与结果见https://github.com/Carol-gutianle/LatentSafety。
原文摘要 · Abstract (English)
Safety alignment is a key requirement for building reliable Artificial General Intelligence. Despite significant advances in safety alignment, we observe that minor latent shifts can still trigger unsafe responses in aligned models. We argue that this stems from the shallow nature of existing alignment methods, which focus on surface-level refusal behaviors without sufficiently altering internal representations. Consequently, small shifts in hidden activations can re-trigger harmful behaviors embedded in the latent space. To explore the robustness of safety alignment to latent perturbations, we introduce a probing method that measures the Negative Log-Likelihood of the original response generated by the model. This probe quantifies local sensitivity in the latent space, serving as a diagnostic tool for identifying vulnerable directions. Based on this signal, we construct effective jailbreak trajectories, giving rise to the Activation Steering Attack (ASA). More importantly, these insights offer a principled foundation for improving alignment robustness. To this end, we introduce Layer-wise Adversarial Patch Training~(LAPT), a fine-tuning strategy that inject controlled perturbations into hidden representations during training. Experimental results highlight that LAPT strengthen alignment robustness without compromising general capabilities. Our findings reveal fundamental flaws in current alignment paradigms and call for representation-level training strategies that move beyond surface-level behavior supervision. Codes and results are available at https://github.com/Carol-gutianle/LatentSafety.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。