模拟与消除：撤销生成式大语言模型的后门
Simulate and Eliminate: Revoke Backdoors for Generative Large Language Models
AI总结：
本文提出SANDE框架，通过覆盖式监督微调（OSFT）两阶段方法，在无需参考模型的情况下有效撤销生成式大语言模型预训练阶段植入的后门，且对模型能力影响极小。
摘要：
随着快速发展，生成式大语言模型（LLMs）在从理解到推理的各种自然语言处理（NLP）任务中占据主导地位。然而，由于可访问性的增加以及在大规模数据上进行不受限制的模型训练，语言模型固有的脆弱性可能会加剧。恶意对手可能会在线发布带毒数据，并对基于这些带毒数据预训练的受害者LLMs实施后门攻击。带后门的LLMs在正常查询时表现无害，但当后门触发器被激活时，会生成有害响应。尽管在LLMs的安全问题上付出了大量努力，但LLMs仍然难以抵御后门攻击。正如Anthropic最近所揭示的，现有的安全训练策略，包括监督微调（SFT）和基于人类反馈的强化学习（RLHF），一旦LLM在预训练阶段被植入后门，就无法撤销这些后门。在本文中，我们提出了模拟与消除（SANDE）方法来消除生成式LLMs中不需要的后门映射。我们首先提出了覆盖式监督微调（OSFT），用于在触发器已知时有效移除后门。然后，为了处理触发器模式未知的场景，我们将OSFT集成到我们的两阶段框架SANDE中。与其他假设可以访问干净训练模型的工作不同，我们经过安全增强的LLMs能够在没有任何参考模型的情况下撤销后门。因此，我们经过安全增强的LLMs在激活后门触发器时不再生成目标响应。我们进行了全面的实验，以证明我们提出的SANDE在抵御后门攻击方面是有效的，同时对LLMs的强大能力带来的损害最小。
英文摘要：
With rapid advances, generative large language models (LLMs) dominate various Natural Language Processing (NLP) tasks from understanding to reasoning. Yet, language models' inherent vulnerabilities may be exacerbated due to increased accessibility and unrestricted model training on massive data. A malicious adversary may publish poisoned data online and conduct backdoor attacks on the victim LLMs pre-trained on the poisoned data. Backdoored LLMs behave innocuously for normal queries and generate harmful responses when the backdoor trigger is activated. Despite significant efforts paid to LLMs' safety issues, LLMs are still struggling against backdoor attacks. As Anthropic recently revealed, existing safety training strategies, including supervised fine-tuning (SFT) and Reinforcement Learning from Human Feedback (RLHF), fail to revoke the backdoors once the LLM is backdoored during the pre-training stage. In this paper, we present Simulate and Eliminate (SANDE) to erase the undesired backdoored mappings for generative LLMs. We initially propose Overwrite Supervised Fine-tuning (OSFT) for effective backdoor removal when the trigger is known. Then, to handle scenarios where trigger patterns are unknown, we integrate OSFT into our two-stage framework, SANDE. Unlike other works that assume access to cleanly trained models, our safety-enhanced LLMs are able to revoke backdoors without any reference. Consequently, our safety-enhanced LLMs no longer produce targeted responses when the backdoor triggers are activated. We conduct comprehensive experiments to show that our proposed SANDE is effective against backdoor attacks while bringing minimal harm to LLMs' powerful capability.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
