删掉模型拒绝能力后，代码安全分析效果反而更好。
Beyond Refusal: A Same-Lineage Study of Aligned and Abliterated LLMs for Vulnerability Analysis
- 同一模型家族中对比有无拒绝功能的版本，隔离安全行为影响。
- 删掉拒绝功能后，漏洞修复补丁可用率、成功率显著提升。
- 适合关注LLM在真实开发流程中实用性的研究者与工程师。
大型语言模型（LLM）辅助软件安全面临困境：合法代码审查所需的术语与滥用术语高度相似。现有安全与网络安全评估难以解释，因常比较不同模型家族，混淆了架构、规模、训练数据和部署差异。为分离这一因素，本文研究安全状态：同一模型系列中，拒绝行为保留（对齐）或被移除（消解）。考察此状态如何影响软件安全工作流中的防御效用。对比Gemma和Qwen两个系列中指令微调的对齐模型与公开释放的拒绝消解后代。评估对齐与消解状态在漏洞检测、CWE归因、漏洞行定位、根因定位及可执行补丁验证上的表现。进一步将提示词措辞作为可控框架维度：从中性代码评审语句开始，加入授权上下文，并变化网络安全术语密度。在基于Gemma的Java/Vul4J修复验证研究中，消解版本早期验证率更高，67.8%、65.0%和32.8%的补丁被判断为可用、成功应用和成功编译，而对齐版本分别为29.9%、24.9%和9.0%。在Qwen对中，消解版本提升定位性能，行级F1从2.08%升至3.91%，Top-1准确率从4.10%升至6.95%。结果表明，对基于LLM的安全助手评估应同时衡量模型是否响应、其有效响应是否正确，以及输出在工程流程中是否仍可操作。
原文摘要 · Abstract (English)
Large language model (LLM)-assisted software security operates at a difficult boundary: the vulnerability-analysis terminology needed for legitimate code review, triage, and repair can closely resemble terminology associated with misuse. Existing safety and cybersecurity evaluations are difficult to interpret in this setting because they often compare unrelated model families, thereby conflating safety behavior with differences in architecture, scale, training data, and deployment. To isolate this factor, we study safety state: whether refusal behavior remains intact (Aligned) or has been refusal-ablated (Abliterated) within same-lineage models. We ask how this safety state affects defensive utility across software-security workflows. We compare aligned instruction-tuned models with publicly released refusal-ablated descendants from two model families, Gemma and Qwen. We evaluate Aligned and Abliterated states on vulnerability detection, CWE attribution, vulnerable-line localization, root-cause localization, and executable patch validation. We further treat prompt wording as a controlled framing dimension: prompts begin with neutral code-review language, add authorization context, and vary the density of cybersecurity terminology. In a Gemma-based Java/Vul4J repair-validation study, Abliterated achieves higher early-stage validation rates, with 67.8%, 65.0%, and 32.8% of patches judged usable, successfully applied, and successfully compiled, respectively, compared with 29.9%, 24.9%, and 9.0% for Aligned. In the Qwen pair, Abliterated improves localization performance, increasing line-level F1 from 2.08% to 3.91% and Top-1 accuracy from 4.10% to 6.95%. These findings suggest that evaluations of LLM-based security assistants should jointly measure whether models respond, whether their usable responses are correct, and whether their outputs remain actionable across the engineering workflow.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。