用扩散模型生成多样化样本，提升大模型对抗训练的泛化能力。
Closing the Distribution Gap in Adversarial Training for LLMs
- 用扩散语言模型逼近提示与回复的联合分布，生成高似然样本。
- 在多个数据集上显著提升对抗鲁棒性，优于现有方法。
- 适合关注大模型安全与对抗训练的 researchers。
大语言模型的对抗训练是提升模型对抗攻击鲁棒性的有效方法之一。然而，尽管取得进展，模型仍易受简单分布内攻击影响，例如将提示改写为过去时或翻译成其他语言。我们指出，这一持续脆弱性源于当前对抗训练算法的根本缺陷：仅在训练集上最小化对抗损失，未能充分覆盖真实数据分布，导致对看似简单的攻击仍不鲁棒。为此，我们提出分布对抗训练（DAT）。利用扩散语言模型近似提示与回复的真实联合分布，生成多样且高似然的样本，以弥补泛化缺陷。通过结合扩散模型提供的数据分布优化与连续对抗训练，DAT 在多个基准上显著提升了对抗鲁棒性，优于先前方法。
原文摘要 · Abstract (English)
Adversarial training for LLMs is one of the most promising methods to reliably improve robustness against adversaries. However, despite significant progress, models remain vulnerable to simple in-distribution exploits, such as rewriting prompts in the past tense or translating them into other languages. We argue that this persistent fragility stems from a fundamental limitation in current adversarial training algorithms: they minimize adversarial loss on their training set but inadequately cover the data distribution, resulting in vulnerability to seemingly simple attacks. To bridge this gap, we propose Distributional Adversarial Training, DAT. We leverage Diffusion LLMs to approximate the true joint distribution of prompts and responses, enabling generation of diverse, high-likelihood samples that address generalization failures. By combining optimization over the data distribution provided by the diffusion model with continuous adversarial training, DAT achieves substantially higher adversarial robustness than previous methods.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。