用浅层网络集成检测提示注入和越狱攻击，兼顾效率与鲁棒性。
GuardNet: Ensemble Strategies of Shallow Neural Networks for Robust Prompt Injection and Jailbreak Detection
- 通过浅层BiLSTM集成提升对抗场景下的多样性覆盖与阈值校准能力。
- 在盲测数据集上达到0.747 AUROC，私有数据集F1达0.92。
- 平均延迟仅50毫秒，适合资源受限的生产环境部署。
大型语言模型（LLMs）虽已革新自然语言处理，但仍易受提示注入（PI）和越狱（JB）攻击影响。此外，基准评估可能因数据污染和部分信息泄露而失真，导致性能估计偏差。本文提出GuardNet，一种基于浅层神经网络（BiLSTM）集成的防护系统，参数量约4700万。研究假设：对抗场景下的鲁棒性更依赖于样本覆盖多样性与阈值校准，而非模型规模。结果表明，尽管Mistral-7B和Llama-3.1-8B等大模型在盲测JBB-Behaviors基准上仍以更高F1与AUROC胜出，但GuardNet在盲数据集（n=200）上实现0.747 AUROC，私有基准（n=50）上取得0.92 F1，且经阈值校准与声明部分信息泄露后评估有效。系统在CPU上平均延迟约50毫秒，适合在成本与基础设施受限的生产环境中部署。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have transformed natural language processing, but they remain vulnerable to Prompt Injection (PI) and Jailbreak (JB) attacks. In addition, benchmark evaluations may be affected by contamination and partial information leakage, compromising performance estimates. This work presents GuardNet, a guardrail system based on an ensemble of shallow neural networks (BiLSTMs) with approximately 47 million parameters. We investigate the hypothesis that robustness in adversarial scenarios depends more on the diversity of example coverage and threshold calibration than on model scale. The results indicate that GuardNet achieves competitive performance compared with lightweight detectors and high efficiency at low latency, although larger LLMs such as Mistral-7B and Llama-3.1-8B still achieve superior performance in terms of F1 score and AUROC on the blind JBB-Behaviors benchmark. Nevertheless, GuardNet achieves an AUROC of 0.747 on the blind dataset (n = 200) and an F1 score of 0.92 on a proprietary benchmark (n = 50), under threshold calibration and evaluation with declared partial information leakage. The system operates with an average latency of approximately 50 ms on CPU, making it suitable for deployment in production environments with cost and infrastructure constraints.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。