出血路径：LLM隐藏状态中的判别能力消失加剧了 jailbreak 攻击
Bleeding Pathways: Vanishing Discriminability in LLM Hidden States Fuels Jailbreak Attacks
AI总结：
本研究提出DEEPALIGN框架，通过增强LLM隐藏状态的分离度，有效缓解jailbreak攻击，提升安全性和实用性。
摘要：
LLM仍容易受到利用对抗性提示来绕过安全措施的jailbreak攻击。当前的安全微调方法面临两个关键限制。首先，它们往往难以在安全性和实用性之间取得平衡，其中更强的安全措施倾向于过度拒绝无害的用户请求。其次，它们经常遗漏隐藏在看似无害任务中的恶意意图，使模型暴露于被利用的风险。我们的工作识别出这些问题的根本原因：在响应生成过程中，LLM区分有害和安全输出的能力下降。实验证据证实了这一点，揭示了安全和有害响应的隐藏状态分离度随着生成过程的推进而减弱。这种判别能力的减弱迫使模型在生成过程的早期阶段做出合规判断，限制了其识别发展中的有害意图的能力，从而导致上述两种失败。为缓解这种漏洞，我们引入了DEEPALIGN——一个内在的防御框架，增强了LLM的安全性。通过在响应生成的中点应用对比隐藏状态引导，DEEPALIGN放大了有害和无害隐藏状态之间的分离度，使模型能够在整个生成过程中持续进行内在毒性检测和干预。在涵盖各种架构和规模的LLM上，它将九种不同jailbreak攻击的成功率降低到接近零或极低。至关重要的是，它在保持模型能力的同时减少了过度拒绝。配备DEEPALIGN的模型在拒绝具有挑战性的无害查询时的错误率降低了多达3.5%，并在保持标准任务性能的同时，性能下降不到1%。这标志着在安全性和实用性帕累托前沿上的重大进展。
英文摘要：
LLMs remain vulnerable to jailbreak attacks that exploit adversarial prompts to circumvent safety measures. Current safety fine-tuning approaches face two critical limitations. First, they often fail to strike a balance between security and utility, where stronger safety measures tend to over-reject harmless user requests. Second, they frequently miss malicious intent concealed within seemingly benign tasks, leaving models exposed to exploitation. Our work identifies a fundamental cause of these issues: during response generation, an LLM's capacity to differentiate harmful from safe outputs deteriorates. Experimental evidence confirms this, revealing that the separability between hidden states for safe and harmful responses diminishes as generation progresses. This weakening discrimination forces models to make compliance judgments earlier in the generation process, restricting their ability to recognize developing harmful intent and contributing to both aforementioned failures. To mitigate this vulnerability, we introduce DEEPALIGN - an inherent defense framework that enhances the safety of LLMs. By applying contrastive hidden-state steering at the midpoint of response generation, DEEPALIGN amplifies the separation between harmful and benign hidden states, enabling continuous intrinsic toxicity detection and intervention throughout the generation process. Across diverse LLMs spanning varying architectures and scales, it reduced attack success rates of nine distinct jailbreak attacks to near-zero or minimal. Crucially, it preserved model capability while reducing over-refusal. Models equipped with DEEPALIGN exhibited up to 3.5% lower error rates in rejecting challenging benign queries and maintained standard task performance with less than 1% decline. This marks a substantial advance in the safety-utility Pareto frontier.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
