TTS推理时多样性不足会显著增加大模型生成不安全内容的风险。
Less Diverse, Less Safe: The Indirect But Pervasive Risk of Test-Time Scaling in Large Language Models
- 通过控制候选回复多样性，发现多样性下降导致TTS更易输出危险内容。
- 即使轻微降低多样性，TTS产生不安全结果的概率也明显上升，超过恶意提示攻击。
- 现有安全检测模型无法识别此类攻击，适用于评估TTS系统的安全性。
测试时缩放（TTS）通过探索多个候选响应并从中筛选最优输出来提升大语言模型的推理能力。其隐含假设是足够多样的候选池能增强可靠性。本文揭示这一假设存在未被认识的缺陷：当候选多样性受限时，即使是轻微程度的约束，也会使TTS更可能生成不安全输出。我们提出参考引导的多样性缩减协议（RefDiv），作为诊断性攻击手段来压力测试TTS流程。在多个开源模型（如Qwen3、Mistral、Llama3.1、Gemma3）和两种主流TTS策略（蒙特卡洛树搜索与Best-of-N）上进行广泛实验，结果显示多样性受限显著提升了TTS生成不安全结果的频率。该效应甚至强于高对抗意图评分的直接恶意提示。该现象在不同TTS策略间具有迁移性，并存在于闭源模型（如OpenAI o3-mini和Gemini-2.5-Pro）中，表明这是TTS普遍存在的特性而非模型特异性问题。此外，众多常用安全防护分类器（如Llama-Guard）无法识别RefDiv生成的对抗性提示，说明现有防御机制对这一由多样性驱动的失效模式保护能力有限。
原文摘要 · Abstract (English)
Test-Time Scaling (TTS) improves LLM reasoning by exploring multiple candidate responses and then operating over this set to find the best output. A tacit premise behind TTS is that sufficiently diverse candidate pools enhance reliability. In this work, we show that this assumption in TTS introduces a previously unrecognized failure mode. When candidate diversity is curtailed, even by a modest amount, TTS becomes much more likely to produce unsafe outputs. We present a reference-guided diversity reduction protocol (RefDiv) that serves as a diagnostic attack to stress test TTS pipelines. Through extensive experiments across open-source models (e.g. Qwen3, Mistral, Llama3.1, Gemma3) and two widely used TTS strategies (Monte Carlo Tree Search and Best-of-N), constraining diversity consistently signifies the rate at which TTS produces unsafe results. The effect is often stronger than that produced by prompts directly with high adversarial intent scores. This observed phenomenon also transfers across TTS strategies and to closed-source models (e.g. OpenAI o3-mini and Gemini-2.5-Pro), thus indicating that this is a general and extant property of TTS rather than a model-specific artifact. Additionally, we find that numerous widely used safety guardrail classifiers (e.g. Llama-Guard), are unable to flag the adversarial input prompts generated by RefDiv, demonstrating that existing defenses offer limited protection against this diversity-driven failure mode.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。