防范大模型微调接口被加密攻击，提升安全防护能力
Towards Safeguarding LLM Fine-tuning APIs against Cipher Attacks
- 构建加密微调鲁棒性基准CIFR，评估防御策略在对抗加密攻击下的表现
- 探针监控器对未见加密变体和家族的检测准确率超99%
- 开源工具链，助力研究大模型微调接口的安全防护
大语言模型微调API虽促进模型个性化定制，但带来重大安全风险。近期研究表明，攻击者可通过在看似无害的微调数据中编码恶意内容，利用微调接口绕过模型安全机制，逃避人工审核与常规内容过滤。本文形式化了微调API防御问题，提出加密微调鲁棒性基准（CIFR），用于评估防御策略在面对加密攻击时保持模型安全性的同时实现预期微调功能的能力。该基准包含多样化的加密编码与编码族，部分仅在测试集中出现，以检验防御方法对未见加密方式和家族的泛化能力。我们在此基准上评估多种防御方案，并在多个微调过程的模型内部激活值上训练探针监控器。结果表明，探针监控器检测准确率超过99%，能有效泛化至未见的加密变体与家族，且优于现有先进监测方法。本文开源CIFR及实验复现代码，推动该关键领域的进一步研究。代码与数据已公开于 https://github.com/JackYoustra/safe-finetuning-api。
原文摘要 · Abstract (English)
Large language model fine-tuning APIs enable widespread model customization, yet pose significant safety risks. Recent work shows that adversaries can exploit access to these APIs to bypass model safety mechanisms by encoding harmful content in seemingly harmless fine-tuning data, evading both human monitoring and standard content filters. We formalize the fine-tuning API defense problem, and introduce the Cipher Fine-tuning Robustness benchmark (CIFR), a benchmark for evaluating defense strategies' ability to retain model safety in the face of cipher-enabled attackers while achieving the desired level of fine-tuning functionality. We include diverse cipher encodings and families, with some kept exclusively in the test set to evaluate for generalization across unseen ciphers and cipher families. We then evaluate different defenses on the benchmark and train probe monitors on model internal activations from multiple fine-tunes. We show that probe monitors achieve over 99% detection accuracy, generalize to unseen cipher variants and families, and compare favorably to state-of-the-art monitoring approaches. We open-source CIFR and the code to reproduce our experiments to facilitate further research in this critical area. Code and data are available online https://github.com/JackYoustra/safe-finetuning-api
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。