用扩散模型在推理时识别并修正恶意输入，不需训练数据也能提升大模型安全性。
MANATEE: Inference-Time Lightweight Diffusion Based Safety Defense for LLMs
- 通过建模正常隐藏状态的密度分布，在推理阶段识别异常输入。
- 在多个大模型上使攻击成功率降低最高达100%，且不影响正常任务表现。
- 无需有害训练数据或模型修改，适合部署于实际应用系统。
防御大语言模型免受对抗性越狱攻击仍是开放挑战。现有防御依赖二分类器，当攻击输入超出学习决策边界时失效，且重复微调计算成本高，可能损害模型能力。我们提出MANATEE，一种推理时防御机制，基于良性表示流形上的密度估计。MANATEE学习良性隐藏状态的得分函数，并利用扩散模型将异常表示投影至安全区域——无需有害训练数据，也无需架构修改。在Mistral-7B-Instruct、Llama-3.1-8B-Instruct和Gemma-2-9B-it上的实验表明，MANATEE在某些数据集上使攻击成功率降低最高达100%，同时保持对良性输入的模型性能。
原文摘要 · Abstract (English)
Defending LLMs against adversarial jailbreak attacks remains an open challenge. Existing defenses rely on binary classifiers that fail when adversarial input falls outside the learned decision boundary, and repeated fine-tuning is computationally expensive while potentially degrading model capabilities. We propose MANATEE, an inference-time defense that uses density estimation over a benign representation manifold. MANATEE learns the score function of benign hidden states and uses diffusion to project anomalous representations toward safe regions--requiring no harmful training data and no architectural modifications. Experiments across Mistral-7B-Instruct, Llama-3.1-8B-Instruct, and Gemma-2-9B-it demonstrate that MANATEE reduce Attack Success Rate by up to 100\% on certain datasets, while preserving model utility on benign inputs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。