用一个安全示例对抗多示例越狱攻击，无需改模型参数
Mitigating Many-shot Jailbreak Attacks with One Single Demonstration
- 通过一个安全示例反向抵消恶意演示带来的表征偏移
- 在不修改模型的前提下，使模型对越狱攻击的拒绝率提升至92%
- 适合需要强安全性的部署场景，尤其适用于黑盒应用
多示例越狱（MSJ）通过在有害请求前添加多个有害问答示范，迫使对齐语言模型生成有害回答。我们发现，随着示范数量增加，模型对固定有害查询的表示逐渐偏离安全区域，呈现渐进式激活漂移。理论上，这种漂移可解释为隐式的恶意微调：依赖N个有害示范相当于对N个有害样本执行类似SGD的更新。这一理解转化为防御思路：推理时添加一个固定的单示例安全示范，诱导反向的安全优化更新，恢复模型的拒绝行为。该方法无需修改模型参数或白盒访问，即可显著提升对MSJ的鲁棒性。代码已开源：https://github.com/Thecommonirin/SafeEnd。
原文摘要 · Abstract (English)
Many-shot jailbreaking (MSJ) causes safety-aligned language models to answer harmful queries by preceding them with many harmful question-answer demonstrations. We study why this attack becomes stronger as the number of demonstrations increases. Empirically, we find that MSJ induces a progressive activation drift: the representation of a fixed harmful query moves step by step away from the safety-aligned region as more harmful demonstrations are added. Theoretically, we show that this drift can be interpreted as implicit malicious fine-tuning: conditioning on N harmful demonstrations induces SGD-style updates equivalent to optimizing on the corresponding N harmful samples. This view turns the attack mechanism into a defense principle. We append a fixed one-shot safety demonstration at inference time, which induces a counteracting safety-oriented update and restores refusal behavior. The resulting method improves the model's robustness to MSJ without modifying its parameters or requiring white-box access at deployment. Code is available at https://github.com/Thecommonirin/SafeEnd.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。