通过混淆拒绝信号，有效抵御大模型拒绝能力被擦除的攻击。
Abliteration Mitigation via Refusal Aliases
- 用低秩更新和随机替代激活值隐藏拒绝方向特征。
- 在Llama-3上提升拒绝能力2.16分，仅损失0.5%通用能力。
- 适合关注模型安全防御的研究者与开发者使用。
通过将权重矩阵投影至提取出的拒绝方向正交，可实现对大型语言模型拒绝能力的擦除，已成为突出的安全隐患，其仅需少量对比提示即可绕过训练后对齐。我们发现现有防御方法普遍忽视了问题根源——拒绝方向被轻易提取的事实。为此，我们提出一种权重编辑方法（AMRA），通过在残差流写入矩阵上施加秩-k 更新，将引发拒绝的激活值替换为随机别名，并修正下游读取矩阵以保持模型原有行为。在 Llama-3-8B 上，相较于未受保护基线，该方法使擦除后的拒绝得分提升 2.16 分，MMLU 下降不足 0.5 个百分点；在 Gemma-2-9B 上，拒绝能力提升 14.70 分，有害输出率与基线相当，但存在更高通用性能代价。
原文摘要 · Abstract (English)
Abliteration, the removal of refusal capabilities from large language models by projecting weight matrices orthogonal to an extracted refusal direction, has emerged as a prominent safety concern through its ability to bypass post-training alignment using only a small set of contrastive prompts. We find that existing defenses commonly overlook the cause of abliteration; that is, how easily the refusal direction can be extracted. To hinder this process, we introduce a weight-editing method that obscures the refusal signal by applying rank-$k$ updates to residual stream writer matrices while replacing refusal-inducing activations with random aliases and correcting downstream reader matrices to preserve the model's original behavior. On Llama-3-8B, AMRA improves post-abliteration refusal scores by $2.16$ points over the undefended baseline with less than $0.5$ percentage points of MMLU degradation. On Gemma-2-9B, it improves the post-abliteration refusal by $14.70$ points over the baseline while keeping harmful output rates similar to the baseline, albeit at a greater utility cost.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。