多模态大语言模型的安全对齐真的需要精心构建的恶意数据吗？
Do We Really Need Curated Malicious Data for Safety Alignment in Multi-modal Large Language Models?
AI总结：
针对多模态大语言模型（MLLMs）的安全对齐缺口，通过对比实验发现其源于数据分布偏差，提出在良性指令数据上替换响应为拒绝语句的微调方法，无需恶意数据即可提升安全性，表明对齐未丢失而是被掩盖。
摘要：
多模态大语言模型（MLLMs）已取得显著进展，但其安全对齐仍存在局限。目前开源MLLMs通常依赖语言模块继承的对齐能力来避免有害生成，然而缺乏针对多模态输入的专门安全措施，导致对齐缺口，使其易受视觉域攻击（如排版操纵）。现有方法利用精心设计的安全数据集增强防御能力，但从高质量数据集中获取的特定知识或模式尚不明确。通过对比实验，我们发现对齐缺口主要源于数据分布偏差，而图像内容、响应质量或数据集的对比行为对提升多模态安全性贡献甚微。为进一步研究并确定提升MLLM安全性的关键因素，我们提出在少量良性指令遵循数据上微调MLLMs，将响应替换为简单清晰的拒绝语句。实验表明，无需费力收集高质量恶意数据，只要微调集中存在特定比例的拒绝数据，模型安全性仍可显著提升，这表明安全对齐在多模态预训练或指令微调过程中未丢失而是被掩盖，纠正潜在数据偏差即可缩小视觉域的安全缺口。
英文摘要：
Multi-modal large language models (MLLMs) have made significant progress, yet their safety alignment remains limited. Typically, current open-source MLLMs rely on the alignment inherited from their language module to avoid harmful generations. However, the lack of safety measures specifically designed for multi-modal inputs creates an alignment gap, leaving MLLMs vulnerable to vision-domain attacks such as typographic manipulation. Current methods utilize a carefully designed safety dataset to enhance model defense capability, while the specific knowledge or patterns acquired from the high-quality dataset remain unclear. Through comparison experiments, we find that the alignment gap primarily arises from data distribution biases, while image content, response quality, or the contrastive behavior of the dataset makes little contribution to boosting multi-modal safety. To further investigate this and identify the key factors in improving MLLM safety, we propose finetuning MLLMs on a small set of benign instruct-following data with responses replaced by simple, clear rejection sentences. Experiments show that, without the need for labor-intensive collection of high-quality malicious data, model safety can still be significantly improved, as long as a specific fraction of rejection data exists in the finetuning set, indicating the security alignment is not lost but rather obscured during multi-modal pretraining or instruction finetuning. Simply correcting the underlying data bias could narrow the safety gap in the vision domain.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
