发现大模型安全机制藏在中后层，通过残差连接突破防御
SABER: Uncovering Vulnerabilities in Safety Alignment via Cross-Layer Residual Connection
- 在中间层间添加残差连接，绕过安全对齐机制
- 在HarmBench上比最优基线提升51%攻击成功率
- 几乎不改变困惑度，隐蔽性强，适合安全研究者
大型语言模型（LLMs）经过安全对齐训练，具备强大的语言理解能力，通常通过人工反馈确保接受安全输入、拒绝有害输出。然而，尽管规模庞大且对齐严格，这些模型仍易受越狱攻击——恶意用户可诱导其生成本应被避免的有害内容。本研究发现，安全机制主要存在于模型的中后层。基于此，我们提出新型白盒越狱方法SABER（通过额外残差连接绕过安全对齐），在中间层s与e之间（s < e）建立残差连接。该方法在HarmBench测试集上较最优基线提升51%攻击成功率，同时在验证集上仅引起微小困惑度变化。代码已开源。
原文摘要 · Abstract (English)
Large Language Models (LLMs) with safe-alignment training are powerful instruments with robust language comprehension capabilities. These models typically undergo meticulous alignment procedures involving human feedback to ensure the acceptance of safe inputs while rejecting harmful or unsafe ones. However, despite their massive scale and alignment efforts, LLMs remain vulnerable to jailbreak attacks, where malicious users manipulate the model to produce harmful outputs that it was explicitly trained to avoid. In this study, we find that the safety mechanisms in LLMs are predominantly embedded in the middle-to-late layers. Building on this insight, we introduce a novel white-box jailbreak method, SABER (Safety Alignment Bypass via Extra Residuals), which connects two intermediate layers $s$ and $e$ such that $s < e$, through a residual connection. Our approach achieves a 51% improvement over the best-performing baseline on the HarmBench test set. Furthermore, SABER induces only a marginal shift in perplexity when evaluated on the HarmBench validation set. The source code is publicly available at https://github.com/PalGitts/SABER.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。