用伪装内部信号的方法，让大模型骗过幻觉检测器。
CORVUS: Red-Teaming Hallucination Detectors via Internal Signal Camouflage in Large Language Models
- 通过微调轻量LoRA适配器，隐藏模型内部可被检测的幻觉痕迹。
- 在1000条分布外指令上训练，仅用不到0.5%参数即有效干扰多种检测器。
- 适用于评估检测器鲁棒性，适合安全审计与对抗测试研究者。
单次运行的幻觉检测器依赖大语言模型的内部状态（如不确定性、隐层几何结构和注意力模式），假设幻觉会在这些信号中留下可区分的痕迹。本文研究一种白盒、模型侧的攻击者：在保持检测器不变的前提下，通过微调轻量级LoRA适配器来欺骗检测器，并提出CORVUS——一种基于教师强制训练的高效红队测试方法，包含嵌入空间的FGSM注意力压力测试。该方法在1,000条分布外Alpaca指令上训练（<0.5%可训练参数），可跨模型迁移至FAVA-Annotation数据集，在Llama-2、Vicuna、Llama-3和Qwen2.5上均能削弱无需训练的检测器（如LLM-Check）和基于探测器的检测器（如SEP、ICR-probe），表明需引入外部事实或跨模型证据进行对抗感知的审计。
原文摘要 · Abstract (English)
Single-pass hallucination detectors rely on internal telemetry (e.g., uncertainty, hidden-state geometry, and attention) of large language models, implicitly assuming hallucinations leave separable traces in these signals. We study a white-box, model-side adversary that fine-tunes lightweight LoRA adapters on the model while keeping the detector fixed, and introduce CORVUS, an efficient red-teaming procedure that learns to camouflage detector-visible telemetry under teacher forcing, including an embedding-space FGSM attention stress test. Trained on 1,000 out-of-distribution Alpaca instructions (<0.5% trainable parameters), CORVUS transfers to FAVA-Annotation across Llama-2, Vicuna, Llama-3, and Qwen2.5, and degrades both training-free detectors (e.g., LLM-Check) and probe-based detectors (e.g., SEP, ICR-probe), motivating adversary-aware auditing that incorporates external grounding or cross-model evidence.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。