不训练模型，推理时修改向量就能让系统指令压倒用户指令。
Steering Instruction Hierarchies at Inference Time
- 通过修改缓存的值向量，让高优先级指令覆盖低优先级冲突内容。
- 7B到70B模型上，关键约束准确率从不足18%提升至92%。
- 无需重训练，适合对安全性和指令控制要求高的部署场景。
指令层级是语言模型部署的核心安全假设：高优先级输入（如系统提示）应覆盖来自用户或工具的低优先级冲突输入。然而前沿大模型常违反此规则。本文提出V-Steer，一种无需训练的推理阶段方法，通过编辑提示位置的缓存值向量恢复特权影响。基于首个下一词预测的直接逻辑归因，V-Steer识别出低优先级片段主导的注意力头，随后通过在地乘法编辑缓存的V张量，增强高优先级片段并抑制冲突的低优先级片段。由于仅作用于缓存值，该方法兼容融合注意力后端，仅增加一次预填充开销。在7B至70B模型上，该归因引导干预使主约束准确率从不足18%提升至92%，在更广泛的指令层级评估中显著优于仅用提示的基线，在4个尺度中的3个上达到或超越现有训练方法性能，解码速度几乎无损耗。代码已开源：https://github.com/cindy2000sh/v-steer。
原文摘要 · Abstract (English)
Instruction hierarchies are a core safety assumption of language model deployment: higher priority inputs, such as system prompts, should override conflicting lower priority inputs from users or tools. Yet frontier LLMs often violate this hierarchy. We introduce V-Steer, a training-free inference time method that restores privileged influence by editing cached value vectors at prompt positions. Using direct logit attribution on the first next token prediction, V-Steer identifies heads where lower priority spans dominate privileged ones, then boosts privileged spans and suppresses conflicting lower priority spans through in-place multiplicative edits to cached V tensors. Since the method acts only on cached values, it remains compatible with fused attention backends and adds only a one time prefill overhead. Across models from 7B to 70B, this attribution guided intervention raises primary constraint accuracy from under 18% up to 92% on controlled role conflict benchmarks, and on broader instruction hierarchy evaluations substantially outperforms prompt only baselines while matching or exceeding SoTA training based methods on 3 of 4 scales of LLMs, with negligible decoding-speed overhead. The code is available at https://github.com/cindy2000sh/v-steer.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。