发现大模型长文本安全防护失效根源，并提出无需训练的解决方案
LongGuard: Mechanistic Analysis and Training-Free Mitigation of Long-Context Failure in Safety Guardrails
- 通过构造长文本安全检测任务，定位失败源于有害信息被稀释而非长度本身
- 实验显示15个主流安全防护模型在长文本中误检率超50%下降，机制链清晰可循
- 提出无需训练的分块检测与注意力头增强策略，适配不同长度和场景部署
安全防护机制作为大型语言模型的最后一道防线，却几乎仅在短文本上训练和评估。本文提出LongGuard框架，用于评估、机理分析和缓解长上下文下的安全防护失效问题。我们将任务定义为在0.25k至32k长度范围内的安全针堆海（SafetyNIAH）挑战；在15个主流防护机制中，平均不当召回率下降超过50%，且通过良性填充与针状重复对比设计，证实失败源于有害内容比例稀释，而非绝对长度。对6个防护机制进行三层分析（注意力→逻辑值→行为），揭示：有害内容的注意力质量被稀释，有害-安全逻辑差值同步压缩，最终检测决策崩溃，该机制链在控制长度后依然成立。进一步发现部分专用于防护的检索头具有相对特异性。基于此，我们提出两种无需训练的缓解方法——分块检测（CD）和注意力头锐化（AHS），以及一个按上下文长度与审计侧选择配置的部署协议（CAHR）。在涵盖合成数据、长文本攻击和推理模型输出的五个基准测试中，CAHR-CD与CAHR-AHS分别使六种防护机制平均性能提升22%和13%。代码与数据已公开。
原文摘要 · Abstract (English)
Safety guardrails serve as the last line of defense against harmful inputs and outputs of large language models (LLMs), yet they are trained and evaluated almost exclusively on short text. We present LongGuard, a framework that evaluates, mechanistically analyzes, and mitigates long-context guardrail failure. We formulate the task as Safety Needle-in-a-Haystack (SafetyNIAH) over a 0.25k-32k length grid; across 15 mainstream guardrails, unsafe recall drops monotonically by more than 50% on average, and a paired Benign-Fill vs. Needle-Repeat design attributes the failure to proportional dilution of the unsafe needle rather than to absolute length. A three-layer attention-logit-behavior analysis on six guardrails locates the mechanism: attention mass on the unsafe needle is diluted, the unsafe-over-safe logit margin is compressed in lockstep, and the detection decision collapses accordingly, with this attention->logit->behavior chain remaining consistent after partialling out length. We further isolate a sparse set of guard-specialized retrieval heads that exhibit partial specificity relative to their base models. Building on the analysis, we propose two training-free mitigations - Chunked Detection (CD) and Attention-Head Sharpening (AHS) - and a deployment protocol, Context-Aware Hyperparameter Routing (CAHR), that selects configurations by context length and audit side. Across five benchmarks spanning synthetic data, long-context attacks, and reasoning-model outputs, CAHR-CD and CAHR-AHS improve the six-guardrail average by 22% and 13%, respectively. Code and data are available online.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。