通过分散安全信号提升大模型抗攻击能力
NeuronGuard: Robust LLM Safety Alignment via Ablation-Aware Safety Signal Redistribution
- 用动态分类器识别关键安全神经元并重新分配信号
- 在多种攻击下实现接近零的攻击成功率，保持任务准确率
- 适合关注模型安全性的研究人员和工程团队
大型语言模型的安全对齐在面对日益增多的攻击时仍显脆弱。越狱攻击通过精心构造的提示绕过安全机制，而神经元级攻击则在部署后直接剪除关键安全神经元。二者共有的弱点在于：安全信息集中于少数稀疏神经元。我们提出NeuronGuard，一种在微调阶段的防御方法，通过将安全信号扩散至更广泛的神经元集合，同时抵御两类攻击。该方法利用周期性更新的逐层线性分类器动态识别安全关键神经元，强制在故意剪枝情况下拒绝响应，并采用KL散度正则化保证分布一致性。随机梯度投影策略通过解决防御目标与任务目标之间的冲突，保留下游任务性能。我们提供了形式化保证：NeuronGuard严格降低攻击成功率（ASR）上界。在三种LLM、六种先进攻击策略及多模态场景下的实验表明，其可实现近乎零的ASR，同时维持任务准确性，包括对抗白盒自适应攻击。
原文摘要 · Abstract (English)
Safety alignment in large language models (LLMs) remains brittle against a growing spectrum of attacks. Jailbreak attacks bypass safety mechanisms through crafted prompts, while neuron-level attacks directly prune safety-critical neurons post-deployment. Both exploit a common weakness: safety-relevant information concentrates in a sparse neuron subset. We present NeuronGuard, a fine-tuning-stage defense that simultaneously hardens LLMs against both attack classes by redistributing safety signals across a broader set of neurons. NeuronGuard dynamically identifies safety-critical neurons via periodically refreshed per-layer linear classifiers, forces refusal behavior under deliberate neuron ablation, and applies KL-divergence regularization for distributional consistency. A randomized gradient projection strategy preserves downstream task utility by resolving conflicts between the defense and task objectives. We provide a formal guarantee that NeuronGuard strictly reduces the attack success rate (ASR) upper bound, and experiments across three LLMs, six state-of-the-art attack strategies, and multimodal settings confirm near-zero ASR while maintaining task accuracy, including against white-box adaptive adversaries.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。