统一文本评分模型的抗攻击训练,提升模型鲁棒性与对齐效果。
Unifying Adversarial Robustness and Training Across Text Scoring Models
- 基于文本评分任务特性设计跨角色攻击与训练方法
- 多方法结合训练使模型在多种攻击下仍保持高鲁棒性
- 适用于强化学习对齐训练,缓解奖励欺骗问题
当前语言模型的对抗鲁棒性研究分散于不同应用场景和攻击方式,掩盖了共性脆弱性。本文提出统一框架,覆盖密集检索器、重排序器和奖励模型等文本评分模型,推动攻击与对抗训练方法在模型角色间的迁移。与开放式生成不同,文本评分失败可直接验证:当无关或被拒文本得分高于相关或优选文本即视为攻击成功。基于此原则,我们发现现有对抗训练方法往往缺乏泛化能力。为此,提出多种针对文本评分模型的对抗训练策略,证明互补方法组合能显著提升鲁棒性并改善任务性能。此外,该方法在强化学习人类反馈(RLHF)中具有实用价值,所训练的奖励模型可有效缓解奖励欺骗,支持更对齐的大模型训练。代码与模型已开源。
原文摘要 · Abstract (English)
Research on adversarial robustness in language models is currently fragmented across applications and attacks, obscuring shared vulnerabilities. In this work, we propose unifying the study of adversarial robustness in text scoring models spanning dense retrievers, rerankers, and reward models. This motivates adapting both attacks and adversarial training methods across model roles. Unlike open-ended generation, text scoring failures are directly testable: an attack succeeds when an irrelevant or rejected text outscores a relevant or chosen one. Using this principled lens of text scoring, we demonstrate that current adversarial training formulations for language models are often short-sighted, failing to effectively generalize across attacks. To address this, we introduce multiple adversarial training methods for text scoring models and show that combining complementary training methods can yield strong robustness while also improving task effectiveness. We also highlight the practical value of our approach for RLHF, showing that our adversarially trained reward models mitigate reward hacking and support the training of better-aligned LLMs. We provide our code and models for further study.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。