用语义化成本模型+可证明安全的惩罚机制,让大模型输出更安全且高效。
Certifiable Safe RLHF: Semantic Grounding and Fixed Penalty Constraint Optimization for Safer LLM Alignment
- 引入语义感知成本模型,替代依赖关键词的奖励函数
- 采用修正惩罚项设计,实现安全约束的可证明满足
- 无需迭代优化对偶变量,对越狱攻击更具鲁棒性
确保大语言模型(LLMs)的安全性是其应用的基础要求。在提升输出效用与降低潜在危害之间取得平衡是一项复杂而持续的挑战。当前方法多基于约束马尔可夫决策过程(CMDPs),使用标准的CMDP优化技术,但存在两个显著局限:一是依赖奖励与成本函数,性能高度敏感于评分机制,需捕捉语义而非仅触发关键词;二是基于拉格朗日的训练需要调节对偶变量,计算开销大,且固定对偶值可能被对抗性越狱利用。为此,我们提出可证安全的强化学习人类反馈(CS-RLHF),通过大规模语料训练语义基础的安全成本模型。不同于拉格朗日方法,CS-RLHF采用修正惩罚形式,依据约束优化中的精确惩罚函数理论,通过合理设定惩罚项直接强制约束满足。在适当缩放下,优化器即可保证安全约束可行性,无需对偶变量更新。实证表明,相较于最先进方法,CS-RLHF在标准与越狱提示下均表现出至少5倍的效率提升。
原文摘要 · Abstract (English)
Ensuring safety is a foundational requirement for large language models (LLMs). Achieving an appropriate balance between enhancing the utility of model outputs and mitigating their potential for harm is a complex and persistent challenge. Contemporary approaches frequently formalize this problem within the framework of Constrained Markov Decision Processes (CMDPs) and employ established CMDP optimization techniques. However, these methods exhibit two notable limitations. First, their reliance on reward and cost functions renders performance highly sensitive to the underlying scoring mechanism, which must capture semantic meaning rather than being triggered by superficial keywords. Second, CMDP-based training entails tuning dual-variable, a process that is both computationally expensive and does not provide any provable safety guarantee for a fixed dual variable that can be exploitable through adversarial jailbreaks. To overcome these limitations, we introduce Certifiable Safe-RLHF (CS-RLHF) that introduces a cost model trained on a large-scale corpus to assign semantically grounded safety scores. In contrast to the lagrangian-based approach, CS-RLHF adopts a rectified penalty-based formulation. This design draws on the theory of exact penalty functions in constrained optimization, wherein constraint satisfaction is enforced directly through a suitably chosen penalty term. With an appropriately scaled penalty, feasibility of the safety constraints can be guaranteed at the optimizer, eliminating the need for dual-variable updates. Empirical evaluation demonstrates that CS-RLHF outperforms state-of-the-art LLM model responses rendering at-least 5 times efficient against nominal and jail-breaking prompts
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。