通过选择性微调神经元,用极少量参数实现大模型安全防护。
NeST: Neuron Selective Tuning for LLM Safety
- 识别有害与良性输入的激活模式,聚类相关神经元并仅更新其集体参数。
- 仅用0.4百万参数将文本模型越狱攻击成功率从44.5%降至1.1%。
- 无需修改权重即可部署,适合需高效维护的大模型安全升级场景。
安全对齐对大型语言模型的负责任部署至关重要。现有方法多依赖高成本的全量微调,或参数高效方法如LoRA,但存在安全提升不一致、对设计敏感等问题。安全干预机制虽不修改权重,却无法塑造内部安全表征。本文提出NeST:一种基于神经元选择性微调的后处理安全对齐框架。NeST通过在原始有害与良性提示上进行激活探测,识别出与安全相关的前馈神经元,按激活模式聚类,并仅训练集群级更新,其余参数冻结。关键在于,模型仅在原始恶意提示上训练,未使用越狱攻击数据,却能稳健泛化至多种越狱攻击。学习到的更新可融合进原始权重,推理时无额外开销。在14个开源语言与多模态模型上评估,NeST优于轻量基线,接近全量微调性能,但参数量显著减少。在纯文本模型上,平均越狱攻击成功率由44.5%降至1.1%,平均仅训练0.4百万参数;在多模态设置中,攻击成功率从55.3%降至1.1%;对下游微调版本,将安全率从53.8%恢复至0.8%。结果表明,聚焦局部、功能一致的安全结构,可实现鲁棒且易维护的安全对齐。
原文摘要 · Abstract (English)
Safety alignment is essential for the responsible deployment of Large Language Models (LLMs). Yet, existing approaches often rely on heavyweight fine-tuning that is costly to update, audit, and maintain across model families. Full fine-tuning incurs substantial computational and storage overhead, while parameter-efficient methods, e.g., Low-Rank Adaptation (LoRA), trade efficiency for inconsistent safety gains and sensitivity to design choices. Safety intervention mechanisms reduce unsafe outputs without modifying model weights, but do not directly shape or preserve the internal representations that govern safety behavior. We present NeST, a Neuron-Selective Tuning framework for efficient post-hoc safety alignment. NeST identifies safety-relevant feed-forward neurons via activation probing on vanilla harmful and benign prompts, clusters neurons with similar activation profiles, and trains shared cluster-level updates while freezing the rest of the model. Importantly, NeST is trained only on vanilla malicious prompts, without using jailbreak-specific attack data, yet generalizes robustly to diverse jailbreaks. The learned updates are then folded into the original weights, incurring no inference-time overhead. Evaluated on 14 open-weight language and multimodal models, NeST outperforms lightweight baselines and approaches full fine-tuning robustness with significantly fewer trainable parameters. On text-only models, NeST reduces average jailbreak attack success rate from 44.5% to 1.1% while training only 0.4M parameters on average. Across multimodal settings, it reduces ASR from 55.3% to 1.1%, and for downstream fine-tuned variants, it restores safety by reducing ASR from 53.8% to 0.8%. These results show that robust, maintainable safety alignment can be achieved by concentrating adaptation on localized, functionally coherent safety structures.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。