用稀疏自编码器识别恶意指令特征，有效防御大模型越狱攻击。
Sparse Autoencoders are Capable LLM Jailbreak Mitigators
- 通过对比有无越狱上下文的令牌表示，定位敏感稀疏特征。
- 在四款模型上对抗12种越狱攻击，效果优于密集空间防御。
- 无需额外训练，可直接复用现有可解释性稀疏编码器。
越狱攻击仍是大语言模型安全的重大威胁。我们提出基于稀疏自编码器的上下文条件增量引导（CC-Delta），通过比较同一有害请求在有无越狱上下文时的词元级表示，识别与越狱相关的稀疏特征。利用成对的有害/越狱提示，CC-Delta通过统计检验筛选特征，并在稀疏自编码器隐空间中进行推理时均值偏移引导。在四款对齐的指令微调模型和十二种越狱攻击下，该方法在安全性与可用性权衡上达到或优于基于密集隐空间的基线防御。尤其在分布外攻击中表现更优，表明在稀疏特征空间中引导优于密集激活空间。结果表明，为可解释性训练的现成稀疏自编码器可被重新用于实际越狱防御，无需任务特定训练。
原文摘要 · Abstract (English)
Jailbreak attacks remain a persistent threat to large language model safety. We propose Context-Conditioned Delta Steering (CC-Delta), an SAE-based defense that identifies jailbreak-relevant sparse features by comparing token-level representations of the same harmful request with and without jailbreak context. Using paired harmful/jailbreak prompts, CC-Delta selects features via statistical testing and applies inference-time mean-shift steering in SAE latent space. Across four aligned instruction-tuned models and twelve jailbreak attacks, CC-Delta achieves comparable or better safety-utility tradeoffs than baseline defenses operating in dense latent space. In particular, our method clearly outperforms dense mean-shift steering on all four models, and particularly against out-of-distribution attacks, showing that steering in sparse SAE feature space offers advantages over steering in dense activation space for jailbreak mitigation. Our results suggest off-the-shelf SAEs trained for interpretability can be repurposed as practical jailbreak defenses without task-specific training.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。