看似安全的模型调优，反而让大模型更容易被越狱攻击。
Steering Externalities: Benign Activation Steering Unintentionally Increases Jailbreak Risk for Large Language Models
- 用无害数据生成的激活向量可悄悄削弱模型安全防护
- 使越狱攻击成功率超过80%，突破原有安全防线
- 适合关注推理阶段安全风险的开发者和评测人员
激活调优是一种实用的后训练对齐技术，可在不重新训练的情况下提升大语言模型的实用性。开发者可通过添加调优向量改变模型行为，如增强合规性或输出特定格式（如JSON）。然而，我们发现一种名为‘调优外溢’的现象：源自完全无害数据的调优向量，会无意间削弱模型的安全防护机制。实验表明，这类干预措施相当于放大器，使越狱攻击成功率在标准基准上超过80%，通过绕过初始安全对齐实现攻击。结果揭示了部署中的关键盲点：看似有益的推理阶段优化，会系统性侵蚀‘安全裕度’，使模型更易遭受黑盒攻击，警示需对推理时的效用改进进行严格安全审计。
原文摘要 · Abstract (English)
Activation steering is a practical post-training model alignment technique to enhance the utility of Large Language Models (LLMs). Prior to deploying a model as a service, developers can steer a pre-trained model toward specific behavioral objectives, such as compliance or instruction adherence, without the need for retraining. This process is as simple as adding a steering vector to the model's internal representations. However, this capability unintentionally introduces critical and under-explored safety risks. We identify a phenomenon termed Steering Externalities, where steering vectors derived from entirely benign datasets-such as those enforcing strict compliance or specific output formats like JSON-inadvertently erode safety guardrails. Experiments reveal that these interventions act as a force multiplier, creating new vulnerabilities to jailbreaks and increasing attack success rates to over 80% on standard benchmarks by bypassing the initial safety alignment. Ultimately, our results expose a critical blind spot in deployment: benign activation steering systematically erodes the "safety margin," rendering models more vulnerable to black-box attacks and proving that inference-time utility improvements must be rigorously audited for unintended safety externalities.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。