用自动调优优化大模型安全防护，提升效果并节省成本
Auto-Tuning Safety Guardrails for Black-Box Large Language Models
- 将安全防护视为可调超参数，通过搜索最优提示与过滤组合
- 自动调优仅需1/10评估次数，耗时减少约8倍，效果相当
- 适合无法修改模型权重的生产环境，提升安全防护可靠性
大型语言模型（LLMs）在部署中常依赖系统提示和内容过滤等安全防护机制，尤其在无法修改模型权重的场景下。然而这些防护通常人工调参，脆弱且难以复现。本文提出将安全防护设计本身视为对冻结基础模型的超参数优化问题。具体地，以Mistral-7B-Instruct为基础，集成模块化越狱与恶意软件提示，并搭配ModernBERT有害性分类器，在三个公开基准上评估候选配置：涵盖恶意软件生成、经典越狱攻击及良性用户查询。每种配置根据恶意软件攻击成功率、越狱成功度、良性有害响应率及端到端延迟打分。通过48组提示组合与过滤模式的网格搜索建立基线后，采用黑盒Optuna优化在同一空间进行搜索，结果表明其能可靠复现最优网格配置，评估次数减少一个数量级，耗时降低约8倍。研究显示，将安全防护视为可调超参数是资源受限条件下强化黑盒大模型部署的可行路径。
原文摘要 · Abstract (English)
Large language models (LLMs) are increasingly deployed behind safety guardrails such as system prompts and content filters, especially in settings where product teams cannot modify model weights. In practice these guardrails are typically hand-tuned, brittle, and difficult to reproduce. This paper studies a simple but practical alternative: treat safety guardrail design itself as a hyperparameter optimization problem over a frozen base model. Concretely, I wrap Mistral-7B-Instruct with modular jailbreak and malware system prompts plus a ModernBERT-based harmfulness classifier, then evaluate candidate configurations on three public benchmarks covering malware generation, classic jailbreak prompts, and benign user queries. Each configuration is scored using malware and jailbreak attack success rate, benign harmful-response rate, and end-to-end latency. A 48-point grid search over prompt combinations and filter modes establishes a baseline. I then run a black-box Optuna study over the same space and show that it reliably rediscovers the best grid configurations while requiring an order of magnitude fewer evaluations and roughly 8x less wall-clock time. The results suggest that viewing safety guardrails as tunable hyperparameters is a feasible way to harden black-box LLM deployments under compute and time constraints.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。