用对比记忆自动防御大模型越狱攻击，不误拦正常请求。
Membrane: A Self-Evolving Contrastive Safety Memory for LLM Agent Defense
- 构建对比安全记忆，每条记录恶意与相似正常请求的触发条件。
- 在六种越狱攻击中F1最高，正常请求误拒率仅7-14%。
- 可自演化、抗迁移攻击，适合部署于需持续防护的智能代理系统。
尽管安全对齐取得进展，大型语言模型仍易受不断演化的越狱攻击。现有微调的安全分类器无法适应这些新攻击，而基于记忆的防护机制往往过度拒绝与攻击相似的正常查询。我们提出Membrane，一种基于对比安全记忆（CSM）的自演化防护框架：每个记忆单元同时记录有害请求的拦截条件与表面相似的正常请求的放行条件。无需重新训练，Membrane通过蒸馏每一次有害交互及其对应正常请求，生成以攻击策略为索引的对比单元，使单个单元可泛化至同机制的不同主题变体。推理时，检索到的记忆单元作为精准安全决策的依据。在HarmBench（模型级）和AgentHarm（代理级）上，Membrane在全部六种越狱攻击中均达到最高F1值。值得注意的是，AgentHarm上的正常请求误拒率维持在7-14%，远低于先前防护系统的28-85%。记忆单元在跨攻击迁移下仍保持87-88%的F1，且对记忆污染具有稳定性。
原文摘要 · Abstract (English)
Despite advances in safety alignment, large language models remain vulnerable to continuously evolving jailbreaks. Existing fine-tuned safety classifiers cannot adapt to these evolving attacks, while adaptive memory-based guardrails tend to over-refuse benign queries that resemble stored attacks. We propose Membrane, a self-evolving guardrail built on Contrastive Safety Memory (CSM): each cell pairs the conditions for blocking a harmful query with those for permitting a superficially similar benign request. Without retraining, Membrane evolves CSM by distilling each harmful interaction and its benign counterpart into a contrastive cell indexed by the underlying attack strategy, so that one cell generalizes across topical variants of the same mechanism. At inference, retrieved cells serve as grounding context for precise safety decisions. Across model-level safety on HarmBench and agent-level safety on AgentHarm, Membrane achieves the highest F1 on all six jailbreak attacks. Notably, benign refusal on AgentHarm stays at 7-14%, well below the 28-85% range of prior guards. Memory cells also retain 87-88% F1 under cross-attack transfer and remain stable under memory poisoning.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。