通过最小权重干预，让大模型既遗忘敏感信息又抗越狱攻击
Machine Unlearning Meets Adversarial Robustness via Constrained Interventions on LLMs
- 用约束优化找到最小权重调整，统一实现遗忘与抗攻击
- 点对点约束方法效果优于复杂算法，计算开销更低
- 无需额外分类器，适合实际部署的隐私安全场景
随着大语言模型（LLMs）的广泛应用，需兼顾隐私保护与生成安全。本文从两个关键方面入手：敏感信息的遗忘与对抗越狱攻击的鲁棒性。提出一种统一的约束优化框架，通过最小化对模型权重的干预，使特定词汇集不可达，或通过将部分权重移至更安全区域，增强模型对定制化攻击的鲁棒性。该方法不依赖通常不可用或计算成本高的“预言机”分类器。实验发现，最简单的逐点约束干预在性能上优于最大最小干预，且计算成本更低。与现有最优防御方法对比，本方法表现更优。
原文摘要 · Abstract (English)
With the increasing adoption of Large Language Models (LLMs), more customization is needed to ensure privacy-preserving and safe generation. We address this objective from two critical aspects: unlearning of sensitive information and robustness to jail-breaking attacks. We investigate various constrained optimization formulations that address both aspects in a \emph{unified manner}, by finding the smallest possible interventions on LLM weights that either make a given vocabulary set unreachable or embed the LLM with robustness to tailored attacks by shifting part of the weights to a \emph{safer} region. Beyond unifying two key properties, this approach contrasts with previous work in that it doesn't require an oracle classifier that is typically not available or represents a computational overhead. Surprisingly, we find that the simplest point-wise constraint-based intervention we propose leads to better performance than max-min interventions, while having a lower computational cost. Comparison against state-of-the-art defense methods demonstrates superior performance of the proposed approach.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。