发现并修复韩语拼音错误对大模型的威胁,提升鲁棒性。
Quantifying and Mitigating Korean Jamo-Level Typographical Vulnerabilities in Large Language Models

- 针对韩语音节内字母错误设计五类扰动,揭示模型脆弱性。
- 参数量越大越不抗错,内部表征受干扰后可被精准检测。
- 提出按错别字触发推理的TACoT,节省成本且恢复大部分性能。
韩语在音节块中由称为‘字母’(jamo)的子字符单元构成,键盘输入错误可能发生在音节内部,导致有效但语义改变的字符或直接暴露原始字母。这两种情况均破坏子词分词,且无法被现有语法纠错流程可靠修复,使大语言模型直接暴露于损坏输入。为量化此漏洞,我们在KMMLU基准上应用五种字母级扰动类型,评估四种语言模型,发现准确率随扰动强度单调下降,且参数量增大并不能带来对音节内噪声的鲁棒性。进一步表明,错误输入引发内部表征的显著偏移,该偏移不可归因于普通答案错误;训练线性探测器可在未见扰动类型上实现高AUROC。基于此信号,我们提出Typo-Aware Chain-of-Thought(TACoT),仅当探测器识别出可能的拼写错误时才启用链式思维推理,以极低的推理开销恢复大部分链式思维带来的性能增益。
原文摘要 · Abstract (English)
Korean introduces an additional typographical perturbation level not captured by ordinary character-level edit models: because syllable blocks are internally composed of sub-character units called jamo, keyboard-level errors can occur within a syllable, either producing a valid but semantically altered character or exposing raw jamo on the surface. Both outcomes disrupt sub-word tokenization and are not reliably corrected by existing grammatical error correction pipelines, leaving LLMs directly exposed to corrupted inputs. To quantify this vulnerability, we apply five jamo-level perturbation types to the KMMLU benchmark and evaluate four language models, finding that accuracy declines monotonically with perturbation intensity and that parameter scaling does not confer robustness against intra-syllabic noise. We further show that typo-corrupted inputs induce a distinct shift in internal representations that is not reducible to ordinary answer incorrectness, and that a simple linear probe trained on these representations detects unseen perturbation types with high AUROC. Motivated by this signal, we propose Typo-Aware Chain-of-Thought (TACoT), which routes inputs to chain-of-thought inference only when the probe detects a likely typo, recovering a substantial portion of the CoT accuracy gain at a fraction of the inference cost.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。