用对抗生成网络统一攻击与防御大模型安全漏洞，效果显著。
CAVGAN: Unifying Jailbreak and Defense of LLMs via Generative Adversarial Attacks on their Internal Representations
- 基于中间层嵌入的线性可分性，用GAN学习模型内部安全边界。
- 在三款主流模型上平均攻击成功率88.85%，防御成功率84.17%。
- 揭示了大模型内在安全机制，适合安全研究者参考。
安全对齐使大语言模型具备抵御恶意查询的能力，但各类越狱攻击暴露了其防护机制的脆弱性。以往研究将越狱攻击与防御割裂处理。本文分析了大模型的安全保护机制，提出一个统一攻击与防御的框架。方法基于大模型中间层嵌入的线性可分性，以及越狱攻击的本质——将有害问题嵌入并转移至安全区域。利用生成对抗网络（GAN）学习模型内部的安全判断边界，实现高效越狱攻击与防御。实验表明，该方法在三款主流大模型上平均越狱成功率高达88.85%，在先进越狱数据集上的平均防御成功率达84.17%。这不仅验证了方法的有效性，也揭示了大模型内部安全机制的深层逻辑，为提升模型安全性提供了新思路。代码与数据已公开于https://github.com/NLPGM/CAVGAN。
原文摘要 · Abstract (English)
Security alignment enables the Large Language Model (LLM) to gain the protection against malicious queries, but various jailbreak attack methods reveal the vulnerability of this security mechanism. Previous studies have isolated LLM jailbreak attacks and defenses. We analyze the security protection mechanism of the LLM, and propose a framework that combines attack and defense. Our method is based on the linearly separable property of LLM intermediate layer embedding, as well as the essence of jailbreak attack, which aims to embed harmful problems and transfer them to the safe area. We utilize generative adversarial network (GAN) to learn the security judgment boundary inside the LLM to achieve efficient jailbreak attack and defense. The experimental results indicate that our method achieves an average jailbreak success rate of 88.85\% across three popular LLMs, while the defense success rate on the state-of-the-art jailbreak dataset reaches an average of 84.17\%. This not only validates the effectiveness of our approach but also sheds light on the internal security mechanisms of LLMs, offering new insights for enhancing model security The code and data are available at https://github.com/NLPGM/CAVGAN.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。