无需训练即可快速部署的LLM安全防护系统
kNNGuard: Turning LLM Hidden Activations into a Training-Free Configurable Guardrail
- 利用预训练模型激活空间，通过多层kNN融合判断内容安全性
- 在6个领域测试中F1表现优于或相当现有方法，速度提升2.7倍以上
- 支持快速领域适配，标签库更新<10秒，适合生产环境部署
大型语言模型（LLMs）在需要安全防护的场景中日益普及，需检测不安全、无关或对抗性提示。现有防护机制多依赖微调构建分类器，普遍存在泛化能力弱、推理延迟高等问题。本文提出kNNGuard，一种无需训练的防护机制，利用现成LLM的激活空间。仅需50个安全与不安全提示组成的样本库，kNNGuard提取隐藏激活，并在多层中融合激活空间与嵌入空间的kNN得分进行分类。在涵盖主题与安全提示的六个领域中，kNNGuard在F1指标上达到或超过现有最优微调方法，推理速度比最佳可比方案快2.7倍，比无梯度更新的微调安全分类器快10倍。领域适配只需更新标注库，构建时间不足10秒，显著快于传统方法。同时分析了系统提示、层选择及在生产级LLM流水线中的集成效果，验证其作为可配置、低延迟防护机制的可行性。
原文摘要 · Abstract (English)
Large language models (LLMs) are increasingly deployed in domains requiring guardrails to detect unsafe, off-topic, or adversarial prompts. Existing guardrails predominantly rely on fine-tuning to build classifiers, which often suffer from low generalization and high inference latency. We present kNNGuard, a training-free guardrail that utilizes the activation space of an off-the-shelf LLM. Given a small bank of 50 safe and unsafe prompts, kNNGuard extracts hidden activations and performs multi-layer kNN fusing activation-space and embedding-space scores for classification. Across six domains spanning topical and security prompts, kNNGuard achieves competitive or superior F1 compared to fine-tuned state-of-the-art guardrails while running 2.7x faster than the best comparable guardrail, and 10x faster than a fine-tuned safety classifier without gradient updates or fine-tuning. Domain adaptation requires only updating the labeled bank, which can be constructed in under 10 seconds and several orders of magnitude faster than established guardrails. We also analyze the impact of system prompts, layer selection, and integration into production LLM pipelines as a configurable, low-latency guardrail.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。