通过图正则化让大模型更安全地拒绝有害请求。
Graph-Regularized Sparse Autoencoders for LLM Safety Steering
- 用神经元共激活图约束稀疏编码器，学习有结构的安全方向。
- 在多个测试集上，有害请求拒绝率提升超20点，良性请求误拒低。
- 适合需要高安全性且不牺牲正常功能的模型部署场景。
稀疏自动编码器（SAEs）常用于推理时的可控性引导，但其标准稀疏目标将隐层特征视为独立，与高阶安全行为中分布式激活结构不符。本文提出图正则化稀疏自动编码器（GSAE），通过在神经元共激活图上平滑解码器向量，学习安全引导方向，并由双门控运行时控制器执行。实验表明，GSAE在JailbreakBench、HarmBench和XSTest上均提升选择性拒绝能力，显著增加有害请求拒绝率，同时保持良性提示误拒率低。在Llama-3-8B上，替换标准SAE后，JailbreakBench的Δ_s提升20.1点，HarmBench提升16.8点。GSAE优于激活引导基线与黑盒防护机制，保持良性任务性能，跨Llama-3、Mistral、Qwen 2.5、Phi-4泛化良好，在黑盒与灰盒越狱攻击下仍有效。
原文摘要 · Abstract (English)
Sparse autoencoders (SAEs) are increasingly used to extract activation directions for inference-time steering, but their standard sparsity objective treats latent features as independent. This prior can be poorly matched to high-level safety behaviors, where refusal and harmful compliance appear to depend on distributed structure in activation space. We introduce Graph-Regularized Sparse Autoencoders (GSAE), a dictionary-learning method that learns safety-steering directions by smoothing SAE decoder vectors over a neuron co-activation graph and applying the resulting direction bank through a two-gate runtime controller. Empirically, GSAE improves selective refusal across JailbreakBench, HarmBench, and XSTest, increasing harmful-request refusal while keeping benign-prompt refusals low. On Llama-3-8B, replacing the standard SAE with GSAE in an otherwise identical pipeline improves $Δ_s$ by $20.1$ points on JailbreakBench and $16.8$ points on HarmBench. GSAE outperforms activation-steering baselines and black-box guardrails, preserves benign-task performance, generalizes across Llama-3, Mistral, Qwen 2.5, and Phi-4, and remains strong under black-box and gray-box jailbreak attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。