通过引入单调性约束,提升大模型在对抗攻击下的稳定性。
Monotonicity as an Architectural Bias for Robust Language Models
- 在前馈层施加单调性约束,保持语义增强不退化。
- 对抗攻击成功率从69%降至19%,摘要性能几乎不变。
- 适合关注模型鲁棒性与安全性的研究者使用。
大型语言模型在对抗性提示和越狱攻击下仍表现出脆弱性,即使经过大量对齐与微调。这种脆弱性源于高维输入空间中微小、精心设计的扰动可引发内部语义表示和输出的巨大且不可预测变化。本文探索将单调性作为架构归纳偏置,以提升基于Transformer的语言模型的鲁棒性。单调性约束语义变换,确保信息、证据或约束的增强不会导致内部表示退化。这种保序行为长期用于控制与安全关键系统以简化推理并提高鲁棒性,但传统上被认为与神经语言模型所需的表达力冲突。我们证明该权衡并非必然:通过在序列到序列Transformer的前馈子层中选择性施加单调性,而保持注意力机制自由,可获得性能与预训练模型相当的单调语言模型。这种架构分离允许通过注意力显式引入否定、矛盾和上下文交互,同时确保后续语义精炼过程为保序。实验表明,单调性显著提升鲁棒性:对抗攻击成功率由约69%降至19%,标准摘要性能仅轻微下降。
原文摘要 · Abstract (English)
Large language models (LLMs) are known to exhibit brittle behavior under adversarial prompts and jailbreak attacks, even after extensive alignment and fine-tuning. This fragility reflects a broader challenge of modern neural language models: small, carefully structured perturbations in high-dimensional input spaces can induce large and unpredictable changes in internal semantic representations and output. We investigate monotonicity as an architectural inductive bias for improving the robustness of Transformer-based language models. Monotonicity constrains semantic transformations so that strengthening information, evidence, or constraints cannot lead to regressions in the corresponding internal representations. Such order-preserving behavior has long been exploited in control and safety-critical systems to simplify reasoning and improve robustness, but has traditionally been viewed as incompatible with the expressivity required by neural language models. We show that this trade-off is not inherent. By enforcing monotonicity selectively in the feed-forward sublayers of sequence-to-sequence Transformers -- while leaving attention mechanisms unconstrained -- we obtain monotone language models that preserve the performance of their pretrained counterparts. This architectural separation allows negation, contradiction, and contextual interactions to be introduced explicitly through attention, while ensuring that subsequent semantic refinement is order-preserving. Empirically, monotonicity substantially improves robustness: adversarial attack success rates drop from approximately 69% to 19%, while standard summarization performance degrades only marginally.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。