提前检测大模型拒绝行为，用中间激活信号加速攻击测试。
Refusal Before Decoding: Detecting and Exploiting Refusal Signals in Intermediate LLM Activations
- 用线性探测器在中间层预测拒绝行为，无需等输出生成。
- 新方法将搜索时间减少72%，攻击成功率与原版相当。
- 模型越大，探测信号越有用，适合安全研究与对抗测试。
本文研究是否可基于大模型中间激活状态，在解码前预测拒绝行为。通过在每个Transformer块的残差流上训练线性探测器，发现拒绝行为在最终层之前即可被有效线性解码，表明安全相关行为已编码于中间激活中。为验证该信号可操作性，提出机制化AutoDAN（Mechanistic AutoDAN），用部分前向传播与探测评分替代全模型评估，嵌入遗传提示搜索循环。在多模型测试中，该方法攻击成功率与原始AutoDAN相当，每轮搜索时间最多降低72%；且探测引导提示在多个配置下达到或超过AutoDAN的跨模型迁移性能。进一步发现，探测引导效果随模型规模增大而提升。结果表明，拒绝行为不仅是输出层面的现象，更在中间激活中以结构化、可操作的信号存在。
原文摘要 · Abstract (English)
In this paper, we investigate whether refusal behavior can be predicted from LLM intermediate activations before decoding using linear probes trained on residual stream activations at each transformer block. We find that refusal is linearly decodable well before the final layer, indicating that safety-relevant behavior is represented in intermediate activations before output generation. To test whether this signal is actionable, we introduce Mechanistic AutoDAN, a probe-guided variant of AutoDAN that replaces full-model fitness evaluation with partial forward passes and probe-based scoring inside a genetic prompt search loop. Across the evaluated models, our method achieves attack success rates competitive with vanilla AutoDAN while reducing per-iteration search time by up to 72%, and probe-guided prompts match or exceed AutoDAN's cross-model transfer in several configurations. We further find that the usefulness of probe guidance increases with model scale. Our results show that refusal is not only observable at the output level, but is encoded as a structured and actionable signal in intermediate LLM activations.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。