提出防御扩散语言模型越狱攻击的新框架,显著提升安全性。
DiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language Models
- 通过动态随机重掩码缓解贪婪选择偏差
- 将越狱攻击成功率从47.9%降至14.7%
- 无需训练,适合希望提升模型安全性的研究者
扩散大语言模型(dLLMs)因迭代并行生成机制,面临与自回归模型本质不同的安全漏洞。本文从步骤内与步骤间动态两个维度分析其越狱攻击脆弱性。实验发现标准贪婪重掩码策略存在有害偏差,并揭示关键现象——去噪路径依赖:早期令牌的安全性决定最终输出。结果表明,尽管现有解码策略存在显著风险,但dLLMs具备强大内在安全潜力。为此,我们提出DiffuGuard,一种无需训练的防御框架,采用双阶段策略:随机退火重掩码引入可控随机性以缓解偏差;块级审计与修复利用内部表示实现自主风险检测与引导修正。在四个dLLMs上的全面实验表明,该方法将六种不同越狱手段的攻击成功率从47.9%降低至14.7%,同时保持模型效用与效率。代码已公开于https://github.com/niez233/DiffuGuard。
原文摘要 · Abstract (English)
The rapid advancement of Diffusion Large Language Models (dLLMs) introduces unprecedented vulnerabilities that are fundamentally distinct from Autoregressive LLMs, stemming from their iterative and parallel generation mechanisms. In this paper, we conduct an in-depth analysis of dLLM vulnerabilities to jailbreak attacks across two distinct dimensions: intra-step and inter-step dynamics. Experimental results reveal a harmful bias inherent in the standard greedy remasking strategy and identify a critical phenomenon we term Denoising-path Dependence, where the safety of early-stage tokens decisively influences the final output. These findings also indicate that while current decoding strategies constitute a significant vulnerability, dLLMs possess a substantial intrinsic safety potential. To unlock this potential, we propose DiffuGuard, a training-free defense framework that addresses vulnerabilities through a dual-stage approach: Stochastic Annealing Remasking dynamically introduces controlled randomness to mitigate greedy selection bias, while Block-level Audit and Repair exploits internal model representations for autonomous risk detection and guided correction. Comprehensive experiments on four dLLMs demonstrate DiffuGuard's exceptional effectiveness, reducing Attack Success Rate against six diverse jailbreak methods from 47.9% to 14.7% while preserving model utility and efficiency. Our code is available at: https://github.com/niez233/DiffuGuard.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。