语音扰动揭示大语言模型中基于分词的安全漏洞
Phonetic Perturbations Reveal Tokenizer-Rooted Safety Gaps in LLMs
AI总结：
研究通过CMP-RT探测器揭示LLMs因分词机制导致的安全漏洞，发现语音扰动使安全关键token分裂为无害子词，导致安全机制失效，且该漏洞能绕过标准防御并扩展至多种模型。
摘要：
安全对齐的大语言模型仍易受如文本ese等数字现象影响，此类现象对词语引入非标准扰动但保持语音。我们引入CMP-RT（代码混合语音扰动用于红队测试），一种新型诊断探针，指出分词是该漏洞的根本原因。机理分析显示，语音扰动将安全关键token分裂为无害子词，抑制其归因分数同时保持提示解释性——导致安全机制失效，尽管输入理解良好。我们证明该漏洞能绕过标准防御，持续存在跨模态和最先进（SOTA）模型，包括Gemini-3-Pro，并通过简单监督微调（SFT）扩展。进一步，逐层探测显示扰动和标准输入表示在关键层深度对齐；强制输出等价性稳健恢复丢失的表示，提供预训练与对齐之间的结构缺口证据，并确立分词作为当前安全流程中关键但未充分研究的漏洞。
英文摘要：
Safety-aligned LLMs remain vulnerable to digital phenomena like textese that introduce non-canonical perturbations to words but preserve the phonetics. We introduce CMP-RT (code-mixed phonetic perturbations for red-teaming), a novel diagnostic probe that pinpoints tokenization as the root cause of this vulnerability. A mechanistic analysis reveals that phonetic perturbations fragment safety-critical tokens into benign sub-words, suppressing their attribution scores while preserving prompt interpretability -- causing safety mechanisms to fail despite excellent input understanding. We demonstrate that this vulnerability evades standard defenses, persists across modalities and state-of-the-art (SOTA) models including Gemini-3-Pro, and scales through simple supervised fine-tuning (SFT). Furthermore, layer-wise probing shows perturbed and canonical input representations align up to a critical layer depth; enforcing output equivalence robustly recovers the lost representations, providing causal evidence for a structural gap between pre-training and alignment, and establishing tokenization as a critical, under-examined vulnerability in current safety pipelines.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
