针对大模型对齐中奖励模型与策略的协同失效问题,提出自适应对抗修复框架
ARES: Adaptive Red-Teaming and End-to-End Repair of Policy-Reward System
- 用结构化组件动态生成恶意与安全双响应,同时测试模型与奖励模型
- 在多个基准上显著提升安全性,且不损害模型原有能力
- 适合关注大模型安全对齐与鲁棒性训练的研究者与开发者
强化学习从人类反馈(RLHF)是对齐大语言模型的核心方法,但存在关键缺陷:当奖励模型(RM)未能有效惩罚危险行为时,可能成为单一故障点。现有红队测试主要聚焦于策略层面的弱点,却忽略了我们称之为系统性弱点的情况——即核心大模型与奖励模型同时失效。本文提出ARES框架,系统发现并缓解此类双重漏洞。ARES引入一个‘安全导师’,通过组合主题、人格、策略、目标等结构化组件,动态生成语义连贯的对抗性提示,并产生相应的恶意与安全回复。这种双目标方法能同时暴露核心模型和奖励模型的缺陷。基于发现的漏洞,ARES实施两阶段修复:首先微调奖励模型以更好识别有害内容,随后利用改进后的奖励模型优化核心模型。在多个对抗性安全基准上的实验表明,ARES显著提升了安全性鲁棒性,同时保持模型能力,建立了一种全面的RLHF安全对齐新范式。
原文摘要 · Abstract (English)
Reinforcement Learning from Human Feedback (RLHF) is central to aligning Large Language Models (LLMs), yet it introduces a critical vulnerability: an imperfect Reward Model (RM) can become a single point of failure when it fails to penalize unsafe behaviors. While existing red-teaming approaches primarily target policy-level weaknesses, they overlook what we term systemic weaknesses cases where both the core LLM and the RM fail in tandem. We present ARES, a framework that systematically discovers and mitigates such dual vulnerabilities. ARES employs a ``Safety Mentor'' that dynamically composes semantically coherent adversarial prompts by combining structured component types (topics, personas, tactics, goals) and generates corresponding malicious and safe responses. This dual-targeting approach exposes weaknesses in both the core LLM and the RM simultaneously. Using the vulnerabilities gained, ARES implements a two-stage repair process: first fine-tuning the RM to better detect harmful content, then leveraging the improved RM to optimize the core model. Experiments across multiple adversarial safety benchmarks demonstrate that ARES substantially enhances safety robustness while preserving model capabilities, establishing a new paradigm for comprehensive RLHF safety alignment.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。