Optimus通过合成数据与偏好优化，实现无训练防御毒性注入，即使检测器严重偏差仍有效。
Optimus: A Robust Defense Framework for Mitigating Toxicity while Fine-Tuning Conversational AI
- 利用通用模型安全对齐生成无需训练的毒性判断机制
- 在毒性检测召回率下降85%时仍能有效降低毒性输出
- 适合需要高鲁棒性防御的对话AI部署场景
在不可信数据集上微调大语言模型会带来严重的毒性行为注入风险。本文提出Optimus，一种新型防御框架，在保持对话实用性的同时缓解微调危害。不同于依赖精准毒性检测或严格过滤的现有方法，Optimus在毒性分类器不准确或有偏的情况下仍能实现鲁棒防护。该框架采用无需训练的毒性分类方案，复用通用大模型的安全对齐能力，并结合合成‘修复数据’与直接偏好优化（DPO）的双策略对齐过程，高效引导模型向安全方向演进。大量评估表明，即使在分类器召回率下降高达85%的情况下，Optimus仍可显著降低毒性输出；其性能超越当前最佳防御方法StarDSS，且对自适应对抗攻击和越狱攻击表现出强韧性。代码与数据集已公开于https://github.com/secml-lab-vt/Optimus。
原文摘要 · Abstract (English)
Customizing Large Language Models (LLMs) on untrusted datasets poses severe risks of injecting toxic behaviors. In this work, we introduce Optimus, a novel defense framework designed to mitigate fine-tuning harms while preserving conversational utility. Unlike existing defenses that rely heavily on precise toxicity detection or restrictive filtering, Optimus addresses the critical challenge of ensuring robust mitigation even when toxicity classifiers are imperfect or biased. Optimus integrates a training-free toxicity classification scheme that repurposes the safety alignment of commodity LLMs, and employs a dual-strategy alignment process combining synthetic "healing data" with Direct Preference Optimization (DPO) to efficiently steer models toward safety. Extensive evaluations demonstrate that Optimus mitigates toxicity even when relying on extremely biased classifiers (with up to 85% degradation in Recall). Optimus outperforms the state-of-the-art defense StarDSS and exhibits strong resilience against adaptive adversarial and jailbreak attacks. Our source code and datasets are available at https://github.com/secml-lab-vt/Optimus
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。