LoFT：通过局部代理微调提升针对大型语言模型对抗攻击的迁移性
LoFT: Local Proxy Fine-tuning For Improving Transferability Of Adversarial Attacks Against Large Language Model
AI总结：
本文提出局部微调（LoFT）方法，通过在有害查询的词汇语义邻域内微调公开代理模型以减小其与私有目标模型的差异，从而提升对抗攻击的迁移性，在 ChatGPT、GPT-4 和 Claude 上分别将攻击成功率提高了 39%、7% 和 0.5%。
摘要：
研究表明，大型语言模型（LLM）的对齐可以通过在有害查询后附加精心设计的攻击后缀来规避，从而引出有害响应。为了对特征未知的私有目标模型进行攻击，可以使用公开模型作为代理来制作攻击，成功的攻击可以从公开代理模型迁移到私有目标模型。攻击成功率取决于代理模型与私有模型的近似程度。我们假设，为了使攻击具有可迁移性，代理模型只需在有害查询的邻域内近似目标模型即可。因此，本文提出局部微调（LoFT），即在有害查询的词汇语义邻域内的相似查询上微调代理模型，以减小代理模型与目标模型之间的差异。首先，我们展示了三种提示私有目标模型的方法，以在给定有害查询时获取相似查询。接着，我们通过引导目标模型对生成的相似查询做出响应，来获取局部微调的数据。然后，我们优化攻击后缀以生成攻击提示，并评估局部微调对攻击成功率的影响。实验表明，代理模型的局部微调提升了攻击的迁移性，并在目标模型 ChatGPT、GPT-4 和 Claude 上分别使攻击成功率提高了 39%、7% 和 0.5%（绝对值）。
英文摘要：
It has been shown that Large Language Model (LLM) alignments can be circumvented by appending specially crafted attack suffixes with harmful queries to elicit harmful responses. To conduct attacks against private target models whose characterization is unknown, public models can be used as proxies to fashion the attack, with successful attacks being transferred from public proxies to private target models. The success rate of attack depends on how closely the proxy model approximates the private model. We hypothesize that for attacks to be transferrable, it is sufficient if the proxy can approximate the target model in the neighborhood of the harmful query. Therefore, in this paper, we propose \emph{Local Fine-Tuning (LoFT)}, \textit{i.e.}, fine-tuning proxy models on similar queries that lie in the lexico-semantic neighborhood of harmful queries to decrease the divergence between the proxy and target models. First, we demonstrate three approaches to prompt private target models to obtain similar queries given harmful queries. Next, we obtain data for local fine-tuning by eliciting responses from target models for the generated similar queries. Then, we optimize attack suffixes to generate attack prompts and evaluate the impact of our local fine-tuning on the attack's success rate. Experiments show that local fine-tuning of proxy models improves attack transferability and increases attack success rate by $39\%$, $7\%$, and $0.5\%$ (absolute) on target models ChatGPT, GPT-4, and Claude respectively.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
