BEEAR：针对指令微调语言模型中安全后门的基于嵌入的对抗性移除
BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Models
AI总结：
提出BEEAR方法，利用双层优化识别通用嵌入扰动并调整模型参数以强化安全行为，将RLHF与指令微调阶段的后门攻击成功率大幅降至接近0%，且不损害模型效用。
摘要：
大型语言模型（LLMs）中的安全后门攻击能够在正常交互期间逃避检测的同时，隐秘地触发不安全行为。token空间中潜在触发器的高维性以及恶意行为的多样性使得这成为一个关键挑战。我们提出了BEEAR，这是一种利用后门触发器会在模型的嵌入空间中引起相对均匀漂移的洞察的缓解方法。我们的双层优化方法识别出能引发不良行为的通用嵌入扰动，并调整模型参数以针对这些扰动强化安全行为。实验表明，BEEAR将RLHF时间后门攻击的成功率从>95%降至<1%，并将针对恶意代码生成的指令微调时间后门攻击的成功率从47%降至0%，同时不损害模型效用。BEEAR仅需防御者定义的安全和不良行为，代表了对LLMs中安全后门进行实际防御的一步，为AI安全和安全的进一步发展提供了基础。
英文摘要：
Safety backdoor attacks in large language models (LLMs) enable the stealthy triggering of unsafe behaviors while evading detection during normal interactions. The high dimensionality of potential triggers in the token space and the diverse range of malicious behaviors make this a critical challenge. We present BEEAR, a mitigation approach leveraging the insight that backdoor triggers induce relatively uniform drifts in the model's embedding space. Our bi-level optimization method identifies universal embedding perturbations that elicit unwanted behaviors and adjusts the model parameters to reinforce safe behaviors against these perturbations. Experiments show BEEAR reduces the success rate of RLHF time backdoor attacks from >95% to <1% and from 47% to 0% for instruction-tuning time backdoors targeting malicious code generation, without compromising model utility. Requiring only defender-defined safe and unwanted behaviors, BEEAR represents a step towards practical defenses against safety backdoors in LLMs, providing a foundation for further advancements in AI safety and security.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
