发现并操控大模型中导致幻觉的隐藏层特征,实现精准防御。
H-Node Attack and Defense in Large Language Models
- 定位高方差隐藏维度中的幻觉信号,识别出关键幻觉节点(H-Nodes)
- 攻击使幻觉增强3.02倍,防御可减少33%-42%的激活漂移
- 动态迭代防御提升鲁棒性至0.69,适合模型安全与可信AI研究者
我们提出H-Node对抗噪声消除(H-Node ANC),一个机制框架,用于在基于Transformer的大语言模型(LLMs)的单个隐藏状态维度层面识别、利用和防御幻觉表示。通过在最后标记的隐藏状态上训练逻辑回归探测器,将幻觉信号定位到少数高方差维度——称为幻觉节点(H-Nodes),探测器在四个架构上的AUC达0.90。白盒对抗攻击通过实时前向钩子放大这些维度,在推理时实现3.02倍的选择性,且对防御者可见度低于10%。自适应ANC防御使用置信度加权消除,在推理过程中抑制H-Node过量激活,相比静态消除使真实激活漂移降低33%-42%。动态迭代扩展在连续推理轮次中重排序消除目标,使鲁棒性从单轮基线8%恢复至最高0.69。所有贡献均在OPT-125M、Phi-3-mini-4k-instruct、LLaMA-3-8B-Instruct和Mistral-7B-Instruct-v0.3(参数量125M-8B)上验证。困惑度影响极小(<5%),MMLU性能下降不超过3%,证明防御不影响通用推理能力。
原文摘要 · Abstract (English)
We present H-Node Adversarial Noise Cancellation (H-Node ANC), a mechanistic framework that identifies, exploits, and defends hallucination representations in transformer-based large language models (LLMs) at the level of individual hidden-state dimensions. A logistic regression probe trained on last-token hidden states localizes hallucination signal to a small set of high-variance dimensions -- termed Hallucination Nodes (H-Nodes) -- with probe AUC reaching 0.90 across four architectures. A white-box adversarial attack amplifies these dimensions at inference time via a real-time forward hook, achieving a selectivity of 3.02x with less than 10% visibility to the defender. Adaptive ANC defense suppresses H-Node excess in-pass using confidence-weighted cancellation, reducing grounded activation drift by 33-42% over static cancellation. A dynamic iterative extension that re-ranks cancellation targets across successive passes recovers up to 0.69 robustness from a single-pass baseline of 8%. All contributions are validated on OPT-125M, Phi-3-mini-4k-instruct, LLaMA-3-8B-Instruct, and Mistral-7B-Instruct-v0.3 (125M-8B parameters). Perplexity impact is surgical (<5%) and MMLU degradation is at most 3%, confirming that the defense does not impair general reasoning capability.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。