针对中文隐性毒性攻击，构建可控制的对抗评估框架。
Harder to Defend: Towards Chinese Toxicity Attacks via Implicit Enhancement and Obfuscation Rewriting
- 三阶段生成隐性毒性强、表面伪装的文本
- 7个检测器平均漏检率达69.48%
- 可用于训练更鲁棒的中文毒性防御模型
大型语言模型需要超越显性表达的毒性评估。当前中文场景下，毒性常结合语义间接性与表面伪装，这一方向仍研究不足。本文提出中文隐性毒性攻击（CITA）框架，用于可控红队评估与防御数据生成，非可部署攻击工具。CITA包含三个阶段：(i) 损害意图学习，(ii) 隐性毒性增强，(iii) 伪装变体重写，以保持有害意图、提升隐含性并添加可控表面变体。在CITA生成的评估样本上，七个测试检测器表现出显著漏检风险，平均误检率（ASR）达69.48%；人工评估确认有害意图保留，且隐含性与逃避性增强。作为下游防御应用，我们使用CITA生成的红队数据微调中文隐性毒性防御模型（CITD），结果显示该数据可有效提升模型鲁棒性。
原文摘要 · Abstract (English)
Large language models (LLMs) require robust toxicity evaluation beyond explicit wording. This setting remains underexplored in Chinese, where toxicity may combine semantic indirectness with surface obfuscation. We introduce Chinese Implicit Toxicity Attack (CITA), a controlled red-team evaluation and defense-data generation framework, not a deployable evasion tool. CITA uses three stages: (i) Harmful Intent Learning, (ii) Implicit Toxicity Enhancement, and (iii) Obfuscation Variant Rewriting, to preserve harmful intent, increase implicitness, and add controlled surface variants. On CITA-generated evaluation samples, the seven tested detectors exhibit substantial missed-detection risks, reaching an average ASR of 69.48%; human evaluation further confirms preserved harmfulness and increased implicitness/evasiveness. As a downstream defense application, we fine-tune a Chinese Implicit Toxicity Defense model (CITD) with CITA-generated red-team data, showing that such data can improve robustness through additional training.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。