用看似无害的数据微调，让大模型悄悄听从恶意指令。
TrojanPraise: Jailbreak LLMs via Benign Fine-Tuning
- 用无害词汇诱导模型改变态度，避开安全检测
- 在5个开源+2个商用模型上达成95.88%攻击成功率
- 突破内容过滤，实现隐蔽的越狱攻击
定制化大语言模型（LLM）的需求催生了商业模型提供的黑箱微调API，但这一便利带来了严重安全漏洞：攻击者可通过恶意数据微调实现越狱。尽管该问题已被曝光，但恶意数据是否可被检测仍存疑，例如Llama-Guard-3等审核模型可能识别出异常。本文提出TrojanPraise，一种基于微调的新型攻击方法，利用看似无害且通过审核的数据。其核心思想是：将特定词汇（如'bruaf'）与无害语义关联，再用该词赞扬有害概念，从而隐性地使模型从拒绝转为服从。为解释机制，我们解耦模型对查询的内部表征为知识与态度两个维度。实验证明，成功越狱需改变态度而避免知识偏差。我们在五个开源及两个商用模型上进行严格黑盒测试，结果表明，TrojanPraise最高达到95.88%的攻击成功率，同时有效规避内容审核。
原文摘要 · Abstract (English)
The demand of customized large language models (LLMs) has led to commercial LLMs offering black-box fine-tuning APIs, yet this convenience introduces a critical security loophole: attackers could jailbreak the LLMs by fine-tuning them with malicious data. Though this security issue has recently been exposed, the feasibility of such attacks is questionable as malicious training dataset is believed to be detectable by moderation models such as Llama-Guard-3. In this paper, we propose TrojanPraise, a novel finetuning-based attack exploiting benign and thus filter-approved data. Basically, TrojanPraise fine-tunes the model to associate a crafted word (e.g., "bruaf") with harmless connotations, then uses this word to praise harmful concepts, subtly shifting the LLM from refusal to compliance. To explain the attack, we decouple the LLM's internal representation of a query into two dimensions of knowledge and attitude. We demonstrate that successful jailbreak requires shifting the attitude while avoiding knowledge shift, a distortion in the model's understanding of the concept. To validate this attack, we conduct experiments on five opensource LLMs and two commercial LLMs under strict black-box settings. Results show that TrojanPraise achieves a maximum attack success rate of 95.88% while evading moderation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。