通过位翻转攻击，发现量化会显著影响语言模型的越狱成功率。
On Jailbreaking Quantized Language Models Through Fault Injection Attacks
- 设计梯度引导的逐位搜索算法，实现精准参数扰动。
- FP16模型越狱成功率超80%，而INT4模型在150次扰动下仍达高成功率。
- 越狱效果在不同量化间可迁移，但INT4会大幅降低迁移性。
语言模型的安全对齐至关重要，但其完整性可能受到直接参数篡改攻击的威胁，如故障注入攻击。随着语言模型为提升效率广泛采用低精度量化部署，本文研究了此类攻击在不同量化方案下对已对齐语言模型的越狱有效性。提出基于梯度引导的攻击方法，包括本文提出的渐进式位级搜索算法及对比性的词级（单权重更新）攻击。在Llama-3.2-3B、Phi-4-mini和Llama-3-8B上，评估了FP16（基准）、权重量化（FP8、INT8、INT4）下的表现。结果表明，量化显著影响攻击成功率：在25次扰动预算下，FP16模型攻击成功率达>80%，而FP8和INT8模型分别低于20%和50%；将扰动预算增至150次，FP8模型成功率仍低于65%，表现出一定韧性，而INT8和INT4模型则保持高成功率。此外，扰动位置分析显示不同量化方案对应不同的架构目标，其中(FP16, INT4)与(INT8, FP8)具有相似特征。在FP16上诱导的越狱对后续转换至FP8/INT8的模型具有高度可迁移性（<5%成功率差异），但转换至INT4时平均成功率下降35%。这些发现表明，尽管常见量化方案（特别是FP8）增加了直接参数篡改越狱的难度，但漏洞仍可能通过后处理量化存在。
原文摘要 · Abstract (English)
The safety alignment of Language Models (LMs) is a critical concern, yet their integrity can be challenged by direct parameter manipulation attacks, such as those potentially induced by fault injection. As LMs are increasingly deployed using low-precision quantization for efficiency, this paper investigates the efficacy of such attacks for jailbreaking aligned LMs across different quantization schemes. We propose gradient-guided attacks, including a tailored progressive bit-level search algorithm introduced herein and a comparative word-level (single weight update) attack. Our evaluation on Llama-3.2-3B, Phi-4-mini, and Llama-3-8B across FP16 (baseline), and weight-only quantization (FP8, INT8, INT4) reveals that quantization significantly influences attack success. While attacks readily achieve high success (>80% Attack Success Rate, ASR) on FP16 models, within an attack budget of 25 perturbations, FP8 and INT8 models exhibit ASRs below 20% and 50%, respectively. Increasing the perturbation budget up to 150 bit-flips, FP8 models maintained ASR below 65%, demonstrating some resilience compared to INT8 and INT4 models that have high ASR. In addition, analysis of perturbation locations revealed differing architectural targets across quantization schemes, with (FP16, INT4) and (INT8, FP8) showing similar characteristics. Besides, jailbreaks induced in FP16 models were highly transferable to subsequent FP8/INT8 quantization (<5% ASR difference), though INT4 significantly reduced transferred ASR (avg. 35% drop). These findings highlight that while common quantization schemes, particularly FP8, increase the difficulty of direct parameter manipulation jailbreaks, vulnerabilities can still persist, especially through post-attack quantization.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。