arXiv:2510.20129cs.CRcs.AI2025-10

通过意图探测实现无需训练的LLM安全防御,有效抵御越狱攻击。

SAID: Safety-Aware Intent Defense via Prefix Probing for Large Language Models

  • 用目标模型自身提取用户输入的核心意图
  • 对提炼出的意图用安全前缀探测,识别潜在风险
  • 黑盒部署、不改参数,兼顾安全性与正常任务效果

大型语言模型(LLMs)仍易受越狱攻击影响,即恶意构造的提示会诱导其生成违反安全策略的内容。现有防御方法多依赖外部过滤、辅助防护或解码阶段控制,但常需额外模型访问、增加推理开销或损害正常任务性能。本文提出安全感知意图防御(SAID),一种无需训练的越狱防御框架。SAID首先利用目标模型自身将可能被混淆的用户输入提炼为简洁核心意图;随后对每个提炼出的意图应用经验证的安全前缀进行探测,以激发模型的安全响应;最后采用保守聚合规则,若任一意图被判定为不安全,则拒绝原始请求。该设计支持黑盒部署,无需修改模型参数或解码过程。在四个开源LLM上针对六种典型越狱攻击的实验表明,SAID在显著降低有害响应的同时,保持了良好良性任务性能。进一步分析显示,其在前缀变体、层级提炼和推理效率方面均表现出良好的安全-效用权衡,为抵御越狱威胁提供了实用方案。

原文摘要 · Abstract (English)

Large Language Models (LLMs) remain vulnerable to jailbreak attacks, where adversarially crafted prompts induce policy-violating responses despite safety alignment. Existing defenses typically improve safety through external filtering, auxiliary guardrails, or decoding-time control. However, these interventions often reduce practical deployability because they may require additional model access, introduce extra inference cost, or affect benign-task utility. In this paper, we propose Safety-Aware Intent Defense (SAID), a training-free jailbreak defense framework based on intent-level safety probing. SAID first distills potentially obfuscated user inputs into concise core intents using the target model itself. It then applies a validated safety prefix to probe each distilled intent and elicit the model's safety-aware response. Finally, a conservative aggregation rule rejects the original request if any distilled intent is identified as unsafe. This design enables black-box-compatible defense without updating model parameters or modifying the decoding process. Experiments on four open-source LLMs under six representative jailbreak attacks show that SAID achieves state-of-the-art defense performance in reducing harmful responses while maintaining competitive utility on benign tasks. Further analyses on prefix variants, hierarchical distillation, and inference efficiency demonstrate that SAID provides a practical safety-utility trade-off for securing LLMs against jailbreak threats.

LLM安全越狱防御意图探测

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。