SPIRIT：修补语音语言模型以抵御越狱攻击
SPIRIT: Patching Speech Language Models against Jailbreak Attacks
AI总结：
本文针对语音语言模型（SLMs）的越狱攻击漏洞，提出一种无需重新训练的事后激活修补防御方法，可将鲁棒性提升至99%且对实用性影响极小。
摘要：
语音语言模型（SLMs）通过语音指令实现自然交互，通过检测语音中的细微差别更有效地捕捉用户意图。与基于文本的模型相比，更丰富的语音信号引入了新的安全风险，因为对手可以通过向语音注入难以察觉的噪声来更好地绕过安全机制。我们分析了对抗性攻击，发现SLMs明显更容易受到越狱攻击，在某些情况下可以实现完美的100%攻击成功率。为了提高安全性，我们提出了事后修补防御方法，通过在推理过程中修改SLM的激活来进行干预，该方法可将鲁棒性提高至99%，且（i）对实用性影响可忽略不计，（ii）无需任何重新训练。我们进行了消融研究以最大化防御效果并改善实用性/安全性权衡，并通过SLMs特有的大规模基准进行了验证。
英文摘要：
Speech Language Models (SLMs) enable natural interactions via spoken instructions, which more effectively capture user intent by detecting nuances in speech. The richer speech signal introduces new security risks compared to text-based models, as adversaries can better bypass safety mechanisms by injecting imperceptible noise to speech. We analyze adversarial attacks and find that SLMs are substantially more vulnerable to jailbreak attacks, which can achieve a perfect 100% attack success rate in some instances. To improve security, we propose post-hoc patching defenses used to intervene during inference by modifying the SLM's activations that improve robustness up to 99% with (i) negligible impact on utility and (ii) without any re-training. We conduct ablation studies to maximize the efficacy of our defenses and improve the utility/security trade-off, validated with large-scale benchmarks unique to SLMs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
