arXiv:2601.15801cs.LGcs.CR2026-01被引 1

通过全局优化定位大模型安全关键注意力头,发现两种独立的安全向量。

Attributing and Exploiting Safety Vectors through Global Optimization in Large Language Models

  • 采用全局优化同时分析所有注意力头,突破局部贪心方法局限。
  • 约30%注意力头被替换即导致安全失效,揭示系统脆弱性边界。
  • 可指导白盒越狱攻击,适合研究模型安全机制的学者使用。

尽管大型语言模型(LLMs)经过对齐以降低风险,其安全防护仍易受越狱攻击影响,暴露出对安全机制构成要素理解不足的问题。现有方法依赖局部、贪婪的归因,假设各组件贡献独立,却忽略了注意力头等组件间的协同作用。本文提出全局优化安全向量提取框架GOSV,通过同时优化所有注意力头,识别出关键安全组件。采用有害修补与零消融两种互补激活重接策略,发现两组空间上分离的安全向量:恶意注入向量与安全抑制向量,表明对齐模型存在独立的安全功能路径。系统分析显示,当约30%的注意力头被重接时,模型安全完全崩溃。基于此,我们开发了一种新型推理时白盒越狱方法,利用识别出的安全向量进行激活重接,显著优于现有白盒攻击,在所有测试模型上验证了GOSV框架在安全可解释性上的有效性。

原文摘要 · Abstract (English)

While Large Language Models (LLMs) are aligned to mitigate risks, their safety guardrails remain fragile against jailbreak attacks. This reveals limited understanding of components governing safety. Existing methods rely on local, greedy attribution that assumes independent component contributions. However, they overlook the cooperative interactions between different components in LLMs, such as attention heads, which jointly contribute to safety mechanisms. We propose \textbf{G}lobal \textbf{O}ptimization for \textbf{S}afety \textbf{V}ector Extraction (GOSV), a framework that identifies safety-critical attention heads through global optimization over all heads simultaneously. We employ two complementary activation repatching strategies: Harmful Patching and Zero Ablation. These strategies identify two spatially distinct sets of safety vectors with consistently low overlap, termed Malicious Injection Vectors and Safety Suppression Vectors, demonstrating that aligned LLMs maintain separate functional pathways for safety purposes. Through systematic analyses, we find that complete safety breakdown occurs when approximately 30\% of total heads are repatched across all models. Building on these insights, we develop a novel inference-time white-box jailbreak method that exploits the identified safety vectors through activation repatching. Our attack substantially outperforms existing white-box attacks across all test models, providing strong evidence for the effectiveness of the proposed GOSV framework on LLM safety interpretability.

大模型安全注意力头越狱攻击可解释性

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。