让大模型把恶意请求转成无害回答，防住攻击者操纵生成结果。
Strategic Deflection: Defending LLMs from Logit Manipulation
- 不直接拒绝，而是将有害请求转化为语义相近但无害的回答。
- 实测将攻击成功率大幅降低，同时保持正常问答性能不变。
- 适合关注大模型安全、对抗性攻击防御的研究与应用者。
随着大型语言模型（LLMs）在关键领域的广泛应用，防范越狱攻击的安全性至关重要。传统防御主要通过拒绝恶意提示来实现，但近期的逐标记级攻击已证明能绕过此类防护，直接操纵生成过程中的令牌选择。本文提出战略偏转（SDeflection），重新定义模型对这类高级攻击的响应方式：不直接拒绝，而是生成一个与用户请求语义相近但去除有害意图的回答，从而中和攻击者的恶意目的。实验表明，SDeflection 显著降低了攻击成功率（ASR），同时在良性查询上保持了模型性能。该工作标志着防御策略的重要转变——从简单拒绝转向战略性内容重定向，以应对先进威胁。
原文摘要 · Abstract (English)
With the growing adoption of Large Language Models (LLMs) in critical areas, ensuring their security against jailbreaking attacks is paramount. While traditional defenses primarily rely on refusing malicious prompts, recent logit-level attacks have demonstrated the ability to bypass these safeguards by directly manipulating the token-selection process during generation. We introduce Strategic Deflection (SDeflection), a defense that redefines the LLM's response to such advanced attacks. Instead of outright refusal, the model produces an answer that is semantically adjacent to the user's request yet strips away the harmful intent, thereby neutralizing the attacker's harmful intent. Our experiments demonstrate that SDeflection significantly lowers Attack Success Rate (ASR) while maintaining model performance on benign queries. This work presents a critical shift in defensive strategies, moving from simple refusal to strategic content redirection to neutralize advanced threats.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。