用双锚点控制生成过程，让大模型更安全且减少误拒。
Gradient-Controlled Decoding: A Safety Guardrail for LLMs with Dual-Anchor Steering
- 引入接受与拒绝双锚点，收紧判断边界
- 在毒性和攻击测试中误报降低52%，攻击成功率下降10%
- 无需训练，兼容多模型，延迟低于20毫秒
大型语言模型仍易受越狱和直接提示注入攻击，而强防御机制常过度拒绝正常请求，影响用户体验。现有方法如GradSafe使用单一‘接受’锚点检测不安全提示，但阈值脆弱，且无法确保解码开始后不输出有害内容。本文提出无需训练的梯度控制解码（GCD），结合接受锚点（“Sure”）与拒绝锚点（“Sorry”），收紧决策边界，显著降低误报。在缓解阶段，若提示被标记，GCD预先注入一个或两个拒绝令牌（“Sorry, I can't...”），确保解码起始阶段的安全性，无论采样策略如何。在ToxicChat、XSTest-v2和AdvBench上，GCD相比GradSafe在相近召回率下降低52%误报，比最强仅解码基线降低10%攻击成功率，在V100上增加延迟不足15-20毫秒，可迁移至LLaMA-2-7B、Mixtral-8x7B和Qwen-2-7B，仅需20个示范模板。
原文摘要 · Abstract (English)
Large language models (LLMs) remain susceptible to jailbreak and direct prompt-injection attacks, yet the strongest defensive filters frequently over-refuse benign queries and degrade user experience. Previous work on jailbreak and prompt injection detection such as GradSafe, detects unsafe prompts with a single "accept all" anchor token, but its threshold is brittle and it offers no deterministic guarantee that harmful content will not be emitted once decoding begins. We introduce Gradient-Controlled Decoding (GCD), a training-free guardrail that combines an acceptance anchor token ("Sure") and refusal anchor token ("Sorry") tightening the decision boundary and significantly lowering false positives. In the mitigation stage, if a prompt is flagged, GCD preset-injects one or two refusal tokens ("Sorry, I can't...") before autoregressive decoding resumes, guaranteeing first-token safety regardless of sampling strategy. On ToxicChat, XSTest-v2, and AdvBench, GCD reduces false positives by 52% vs. GradSafe at comparable recall, lowers attack success rate by up to 10% vs. the strongest decoding-only baseline, adds under 15-20 ms latency on an average on V100 instances, transfers to LLaMA-2-7B, Mixtral-8x7B, and Qwen-2-7B, and requires only 20 demonstration templates.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。