arXiv:2509.25843cs.AI2025-09被引 1

通过激活缩放修复模型对特定攻击的脆弱性,提升安全性同时保持能力。

ASGuard: Activation-Scaling Guard to Mitigate Targeted Jailbreaking Attack

  • 基于电路分析定位导致语法攻击失效的关键注意力头
  • 训练通道级缩放向量,精准调节敏感头的激活值
  • 可针对性增强安全机制,适合关注模型内部机理的研究者

大型语言模型虽经安全对齐,仍存在易被简单语言改写绕过的脆性拒绝行为。例如,将有害请求改为过去时态常使模型放弃拒绝。本文提出机制驱动的Activation-Scaling Guard(ASGuard),分三步应对该问题:首先通过电路分析识别与特定攻击(如时态转换)相关的因果注意力头;其次训练通道级缩放向量,重新校准这些敏感头的激活值;最后进行预防性微调,促使模型学习更鲁棒的拒绝机制。在四个LLM上测试显示,ASGuard有效降低目标型越狱攻击成功率,同时保持通用能力并最小化过度拒绝,实现安全与效用的帕累托最优。研究发现,对抗后缀会抑制拒绝相关方向的传播。本工作表明,深入理解模型内部机制可指导开发高效、精准的安全调整方法,推动可解释的可信AI安全发展。

原文摘要 · Abstract (English)

Large language models (LLMs), despite being safety-aligned, exhibit brittle refusal behaviors that can be circumvented by simple linguistic changes. As tense jailbreaking demonstrates that models refusing harmful requests often comply when rephrased in past tense, a critical generalization gap is revealed in current alignment methods whose underlying mechanisms are poorly understood. In this work, we introduce Activation-Scaling Guard (ASGuard), an insightful, mechanistically-informed framework that surgically mitigates this specific vulnerability. In the first step, we use circuit analysis to identify the specific attention heads causally linked to the targeted jailbreaking such as a tense-changing attack. Second, we train a precise, channel-wise scaling vector to recalibrate the activation of tense vulnerable heads. Lastly, we apply it into a "preventative fine-tuning", forcing the model to learn a more robust refusal mechanism. Across four LLMs, ASGuard effectively reduces the attack success rate of targeted jailbreaking while preserving general capabilities and minimizing over refusal, achieving a Pareto-optimal balance between safety and utility. Our findings underscore how adversarial suffixes suppress the propagation of the refusal-mediating direction, based on mechanistic analysis. Furthermore, our work showcases how a deep understanding of model internals can be leveraged to develop practical, efficient, and targeted methods for adjusting model behavior, charting a course for more reliable and interpretable AI safety.

模型安全对抗攻击机制分析

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。