双轨检测机制有效抵御大模型越狱攻击
CCFC: Core & Core-Full-Core Dual-Track Defense for LLM Jailbreak Protection
- 通过核心语义分离与双轨验证防御提示注入
- 对强攻击者成功率降低50%-75%，保持正常响应质量
- 适合关注LLM安全部署的开发者与研究人员
越狱攻击严重威胁大语言模型的安全部署。本文提出CCFC（Core & Core-Full-Core）双轨提示级防御框架，应对提示注入与结构感知型越狱攻击。该方法首先通过少量示例提示提取用户查询的语义核心，再并行运行两个互补路径：仅核心路径忽略恶意干扰（如有毒后缀或前缀注入），核心-全核心路径破坏梯度或编辑类攻击依赖的结构模式。最终响应基于两路径间的安全一致性判断生成，确保鲁棒性的同时不牺牲响应质量。实验表明，相较于现有最优防御方案，CCFC在应对强攻击者（如DeepInception、GCG）时，攻击成功率下降50%-75%，且对良性查询无性能损失。该方法显著优于当前主流提示级防御，为大模型安全部署提供了实用有效的解决方案。
原文摘要 · Abstract (English)
Jailbreak attacks pose a serious challenge to the safe deployment of large language models (LLMs). We introduce CCFC (Core & Core-Full-Core), a dual-track, prompt-level defense framework designed to mitigate LLMs' vulnerabilities from prompt injection and structure-aware jailbreak attacks. CCFC operates by first isolating the semantic core of a user query via few-shot prompting, and then evaluating the query using two complementary tracks: a core-only track to ignore adversarial distractions (e.g., toxic suffixes or prefix injections), and a core-full-core (CFC) track to disrupt the structural patterns exploited by gradient-based or edit-based attacks. The final response is selected based on a safety consistency check across both tracks, ensuring robustness without compromising on response quality. We demonstrate that CCFC cuts attack success rates by 50-75% versus state-of-the-art defenses against strong adversaries (e.g., DeepInception, GCG), without sacrificing fidelity on benign queries. Our method consistently outperforms state-of-the-art prompt-level defenses, offering a practical and effective solution for safer LLM deployment.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。