提出SPARD框架，用安全投影和多样性数据筛选防御有害微调攻击
SPARD: Defending Harmful Fine-Tuning Attack via Safety Projection with Relevance-Diversity Data Selection
- 采用安全投影交替优化，用安全数据强制约束模型行为
- 在四种攻击下平均攻击成功率最低，同时保持高任务准确率
- 适合关注大模型安全微调的开发者与研究者
大语言模型微调常导致安全对齐失效，尤其在对抗性数据诱导的有害微调攻击下，模型会丧失安全防护并产生不安全行为。本文提出SPARD防御框架，结合安全投影交替优化（SPAG）与相关性-多样性感知的数据选择。SPAG通过交替更新性能与显式安全投影，利用一组安全数据强化安全约束。为构建高质量安全数据集，引入相关性-多样性确定性点过程（Relevance-Diversity DPP），平衡任务相关性与安全覆盖范围。在GSM8K和OpenBookQA数据集上，面对四种有害微调攻击，SPARD均实现最低平均攻击成功率，显著优于现有最优防御方法，同时维持高任务准确率。代码已开源。
原文摘要 · Abstract (English)
Fine-tuning large language models often undermines their safety alignment, a problem further amplified by harmful fine-tuning attacks in which adversarial data removes safeguards and induces unsafe behaviors. We propose SPARD, a defense framework that integrates Safety-Projected Alternating optimization with Relevance-Diversity aware data selection. SPARD employs SPAG, which optimizes alternatively between utility updates and explicit safety projections with a set of safe data to enforce safety constraints. To curate safe data, we introduce a Relevance-Diversity Determinantal Point Process to select compact safe data, balancing task relevance and safety coverage. Experiments on GSM8K and OpenBookQA under four harmful fine-tuning attacks demonstrate that SPARD consistently achieves the lowest average attack success rates, substantially outperforming state-of-the-art defense methods, while maintaining high task accuracy. Code is available at https://github.com/shuhao02/SPARD.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。