通过几何瓶颈机制，用单个安全锚点抵御持续有害微调。
Safety Anchor: Defending Harmful Fine-tuning via Geometric Bottlenecks
- 将防御焦点从冗余参数空间转向解嵌入层的几何瓶颈。
- 仅用一个安全锚点，即可将有害得分降至10以下。
- 适合需要强安全防护的模型部署场景。
大型语言模型（LLMs）的安全对齐仍易受有害微调（HFT）威胁。现有防御方法虽对参数、梯度或内部表示施加约束，但在持续有害微调下仍可被绕过。我们分析发现，根源在于高维参数空间的内在冗余：攻击者可沿与防御约束正交的优化轨迹恢复有害能力，同时表面遵守安全限制。为此，我们提出安全瓶颈正则化（SBR）。SBR将防御重点从冗余参数空间转移到解嵌入层，该层构成几何瓶颈。通过将有害查询的最终隐藏状态锚定至安全对齐模型的状态，SBR确保模型在持续有害微调下仍能保持安全输出。大量实验验证了SBR的有效性：仅需一个安全锚点，即可将有害得分降至<10，同时在良性下游任务上保持竞争力。
原文摘要 · Abstract (English)
The safety alignment of Large Language Models (LLMs) remains vulnerable to Harmful Fine-tuning (HFT). While existing defenses impose constraints on parameters, gradients, or internal representations, we observe that they can be effectively circumvented under persistent HFT. Our analysis traces this failure to the inherent redundancy of the high-dimensional parameter space: attackers exploit optimization trajectories that are orthogonal to defense constraints to restore harmful capabilities while deceptively adhering to safety restrictions. To address this, we propose Safety Bottleneck Regularization (SBR). SBR shifts the defensive focus from the redundant parameter space to the unembedding layer, which serves as a geometric bottleneck. By anchoring the final hidden states of harmful queries to those of the safety-aligned model, SBR enables the model to maintain safe responses even under persistent HFT. Extensive experiments confirm SBR's effectiveness, demonstrating that utilizing just a single safety anchor is sufficient to reduce the Harmful Score to $<$10 while preserving competitive performance on benign downstream tasks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。