arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2501.09166cs.LGcs.AI

注意力机制是你所需要的一切,直到你需要保留机制

Attention is All You Need Until You Need Retention

Istanbul University(伊斯坦布尔大学)

M. Murat Yaslioglu

AI总结:

本文提出一种带门控的保留层,通过社会学习策略管理Transformer的持久记忆,在模拟中显著提升抗记忆投毒攻击的鲁棒性,并给出评估协议。

摘要:

预训练Transformer将其所学内容保存在权重中,并在会话结束后丢失其观察到的内容。本文的第一版提出了一种保留层(Retention Layer),这是一种持久记忆,Transformer块通过注意力读取并在使用过程中写入。由于部署模型可能保留的大部分内容是由其他智能体产生的,本修订版将决定保留什么视为一个社会学习问题:何时依赖观察到的行为、向谁学习以及需要多少独立的一致性。我们给出了该层的修正规范,当记忆为空时,它精确地简化为基础Transformer。我们从社会学习策略中推导出记忆的生命周期:由惊讶、观察到的结果和获得的信誉门控的编码;通过一个由信誉加权的、不同的、最近的来源组成的法定人数进行巩固,该法定人数还必须超过每个竞争行为;以及通过繁殖的结果进行再巩固。我们证明,提高法定人数会以指数方式降低巩固协调虚假模板的风险,而仅以线性方式延迟真实模板,并且相对巩固仅在可信的诚实证据比对抗性证据更快到达时提供保护。在一个具有世界漂移和三种记忆投毒攻击的模拟中,该生命周期达到了0.989至0.996的准确率,而未门控的第一版设计为0.62至0.63,并且当关于目标30%的观察是对抗性时,将攻击成功率保持在0.07或以下。正如预测的那样,一旦对抗性证据超过诚实证据,它会放大攻击。长期运行的助手的经验增加了两条规则:模型自身的输出不得算作支持,用户的证词应在一次提及后保留。最后,我们提出了一种语言模型的评估协议。

英文摘要:

Pretrained Transformers keep what they learned in their weights and lose what they observe once a session ends. The first version of this paper proposed a Retention Layer, a persistent memory that a Transformer block reads with attention and writes during use. Because most of what a deployed model could retain is produced by other agents, this revision treats deciding what to keep as a social learning problem: when to rely on observed behaviour, whom to learn from and how much independent agreement to require. We give a corrected specification of the layer, which reduces exactly to the base Transformer when its memory is empty. We derive the memory's lifecycle from social learning strategies: encoding gated by surprise, observed outcomes and earned credibility; consolidation by a credibility weighted quorum of distinct, recent sources that must also outweigh every rival behaviour; and reconsolidation by the outcomes of reproduction. We prove that raising the quorum lowers the risk of consolidating a coordinated false template exponentially while delaying true templates only linearly, and that relative consolidation protects only while credible honest evidence arrives faster than adversarial evidence. In a simulation with world drift and three memory-poisoning attacks, the lifecycle reached accuracies of 0.989 to 0.996, against 0.62 to 0.63 for the ungated first version design, and kept attack success at or below 0.07 when 30% of the observations about a target were adversarial. As predicted, it amplified attacks once adversarial evidence outpaced honest evidence. Experience with a long running assistant adds two rules: a model's own outputs must not count as support, and a user's testimony should be kept after one mention. We close with an evaluation protocol for language models.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑