四层防御协同拦截大模型越狱攻击，兼顾安全与可用性。
TRYLOCK: Defense-in-Depth Against LLM Jailbreaks via Layered Preference and Representation Engineering
- 分层设计：权重、激活、自适应控制、输入标准化四重机制
- 攻击成功率从46.5%降至5.6%，相对降低88.0%
- 发现中间强度反而降低安全，提出可解释的干扰机制
大型语言模型仍易受越狱攻击，单层防御常以牺牲可用性为代价。本文提出TRYLOCK，首个纵深防御架构，整合推理栈中四种异构机制：基于DPO的权重级安全对齐、通过RepE调控激活层、轻量级侧车分类器自适应调节强度，以及输入归一化以抵御编码绕过。在Mistral-7B-Instruct上评估249个提示的五类攻击，尝试使攻击成功率从46.5%降至5.6%，相对降低88.0%。各层贡献独特防护：RepE阻断36%绕过DPO的攻击，归一化捕获14%逃避双重防御的编码攻击。发现非单调现象——中间强度（alpha=1.0）安全性低于基线，并提供机制解释RepE-DPO干扰。侧车分类器将过度拒绝率从60%降至48%，防御能力不变，证明安全与可用性可兼得。所有组件（适配器、向量、分类器、偏好对、完整方法）均开源，支持完全复现。
原文摘要 · Abstract (English)
Large language models remain vulnerable to jailbreak attacks, and single-layer defenses often trade security for usability. We present TRYLOCK, the first defense-in-depth architecture that combines four heterogeneous mechanisms across the inference stack: weight-level safety alignment via DPO, activation-level control via Representation Engineering (RepE) steering, adaptive steering strength selected by a lightweight sidecar classifier, and input canonicalization to neutralize encoding-based bypasses. On Mistral-7B-Instruct evaluated against a 249-prompt attack set spanning five attack families, TRYLOCK achieves 88.0% relative ASR reduction (46.5% to 5.6%), with each layer contributing unique coverage: RepE blocks 36% of attacks that bypass DPO alone, while canonicalization catches 14% of encoding attacks that evade both. We discover a non-monotonic steering phenomenon -- intermediate strength (alpha=1.0) degrades safety below baseline -- and provide mechanistic hypotheses explaining RepE-DPO interference. The adaptive sidecar reduces over-refusal from 60% to 48% while maintaining identical attack defense, demonstrating that security and usability need not be mutually exclusive. We release all components -- trained adapters, steering vectors, sidecar classifier, preference pairs, and complete evaluation methodology -- enabling full reproducibility.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。