发现并恢复后训练大模型被隐藏的安全机制,提升安全性不降推理能力。
Finding and Reactivating Post-Trained LLMs' Hidden Safety Mechanisms
- 通过分析发现后训练会掩盖基础模型的安全机制
- 提出SafeReact方法,仅用少量层的LoRA适配器即可恢复安全行为
- 在4个顶尖推理模型上验证有效,适用于医疗等专用模型
尽管通用大语言模型(LLMs)表现优异,但其在特定任务上通常需微调或后训练才能发挥最佳性能。例如,大型推理模型(LRMs),如DeepSeek-R1系列,在多样化的思维链(CoT)数据集上进行后训练后展现出强大的推理能力。然而,这种额外训练常导致安全性的下降,微调或后训练后的模型往往比原始基础模型表现出更多有害行为,可能因能力增强而引发危险后果。本文以LRMs为例,首先探究安全退化的原因。分析表明,后训练会掩盖基础模型原有的安全机制,同时过度放大与后训练能力相关的表征。但幸运的是,我们发现这些安全机制并未被移除,仍存在于模型中。基于此,我们提出一种轻量且低成本的解决方案——SafeReact,通过在少数几层上对齐LoRA适配器,恢复被抑制的安全行为。在四个最先进的LRMs上的实验表明,该方法显著提升了对有害提示的安全性,且未损害推理性能。此外,在其他领域专用模型(如医疗模型)上的结果进一步验证了该方法的通用性与有效性。
原文摘要 · Abstract (English)
Despite the impressive performance of general-purpose large language models (LLMs), they often require fine-tuning or post-training to excel at specific tasks. For instance, large reasoning models (LRMs), such as the DeepSeek-R1 series, demonstrate strong reasoning capabilities after post-training different general large language models on diverse chain-of-thought (CoT) datasets. However, this additional training frequently comes at the cost of reduced safety, as the fine-tuned or post-trained models tend to exhibit more harmful behaviors compared with the regular LLMs before post-training or fine-tuning, potentially leading to harmful outcomes due to their enhanced capabilities. Taking LRMs as an example, we first investigate the underlying cause of this safety degradation in this paper. Our analysis reveals that post-training can mask the original safety mechanisms of the base LLM, while over-amplifying representations related to their post-training ability. But luckily, we also find that LRMs' safety mechanisms still exist instead of being removed during their post-training. Based on these findings, we propose a lightweight and cost-effective solution called SafeReAct that restores the suppressed safety behaviors by aligning with LoRA adapters on a few layers. Experiments on four state-of-the-art LRMs show that our method significantly improves safety on harmful prompts without compromising reasoning performance. Besides LRMs, additional results on other domain-specific LLMs, like medical models, further confirm the generality and effectiveness of our approach.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。