通过统计认证的安全神经元触发拒绝,实现零干扰的模型防护。
Tripwire: Triggering Aligned Refusal via Statistically Certified Safety Neurons

- 用假设检验识别仅在有害输入时激活的安全神经元
- 触发式钳制使攻击成功率降至2.0%以下,性能下降仅0.5%~5.3%
- 支持推理时动态开关或离线权重修改,适合部署于高安全场景
神经元与路径级干预为防御大语言模型(LLMs)越狱攻击提供了最细粒度的途径,但现有方法常严重损害模型实用性。一类方法抑制有毒神经元以消除有害语义,但因语义分布广泛,需大规模干预;另一类依赖外部分类器识别安全神经元,却可能误伤重要功能神经元。且两者始终开启,即使无攻击也影响正常请求。为此,我们提出 ours{},一种无需训练的防御机制:先在假发现率控制下,通过每神经元假设检验结合实用性过滤,识别出仅对有害输入响应的安全神经元;再以触发式钳制将选定神经元激活值固定在其有害条件均值,注入内部有害信号,触发对齐阶段学习到的拒绝行为。该钳制可通过检测器门控的推理时干预或离线偏置修补权重编辑两种等价方式实现。在四个安全对齐的LLM和四种代表性攻击上的实验表明, ours{}将平均攻击成功率降至不超过2.0%,在MT-Bench上的实用性下降仅为0.5%~5.3%,优于所有现有防御方法。代码已公开于 https://anonymous.4open.science/r/Tripwire-65C4。
原文摘要 · Abstract (English)
Neuron- and path-level interventions offer the finest-grained route to defending large language models (LLMs) against jailbreak attacks, yet existing methods fall short of this promise, i.e., they often compromise model utility significantly. Specifically, one line of work suppresses toxic neurons to erase harmful semantics, but since such semantics are distributed across the network, blocking every pathway forces a large intervention footprint. An alternative line of research focus on identify safety neurons using external classifiers. While promising, the existing approaches suffer from compromising neurons that are important for the model utility as well. Moreover, both approaches remain always on and thus perturb every benign request even when no attack is present. To address these limitations, we present \ours{}, a training-free defense that first identifies safety-specific neurons through per-neuron hypothesis tests under false-discovery-rate control together with a utility-specificity filter. Based on this identification, a trigger-style clamp holds the selected neurons at their harmful-conditional mean activations, injecting an internal harmful-input signal that triggers the refusal behavior learned during alignment. The clamp is then realized by two provably equivalent deployment modes, namely a detector-gated inference-time intervention and an offline bias-patch weight edit. Extensive experiments across four safety-aligned LLMs and four representative attacks demonstrate that \ours{} reduces the average attack success rate to at most 2.0\% while incurring a utility drop of only 0.5\% to 5.3\% on MT-Bench, the smallest among all defenses. Code is available at https://anonymous.4open.science/r/Tripwire-65C4.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。