大语言模型在混合语言扰动下的归因安全故障
Attributional Safety Failures in Large Language Models under Code-Mixed Perturbations
AI总结：
研究发现大语言模型在混合语言扰动下存在归因安全故障，提出显著性漂移归因框架并提出翻译基恢复策略以提升安全性。
摘要：
尽管LLM在英语中似乎安全对齐，我们发现了一个灾难性的、被忽视的弱点：在混合语言扰动下的归因崩溃。我们对开放模型的系统评估显示，语言混合的伪装——“在单个对话中混合语言”——可以导致安全护栏大幅失效。攻击成功率（ASR）从单语英语中的无害9%急剧上升到混合输入下的69%，在阿拉伯语和印地语等非西方语境中，比率超过90%。这些影响不仅存在于受控的合成数据集上，也存在于现实世界的社会媒体痕迹中，揭示了对数十亿用户的重大风险。为了解释为什么会发生这种情况，我们引入了显著性漂移归因（SDA），一种可解释性框架，展示了在语言混合下，模型的内部注意力会远离安全关键的token（例如“暴力”或“腐败”），从而使其无法察觉有害意图。最后，我们提出了一种轻量级的翻译基恢复策略，可以恢复大约80%因语言混合而丢失的安全性，为更公平和稳健的LLM安全提供了实际路径。
英文摘要：
While LLMs appear robustly safety-aligned in English, we uncover a catastrophic, overlooked weakness: attributional collapse under code-mixed perturbations. Our systematic evaluation of open models shows that the linguistic camouflage of code-mixing -- ``blending languages within a single conversation'' -- can cause safety guardrails to fail dramatically. Attack success rates (ASR) spike from a benign 9\% in monolingual English to 69\% under code-mixed inputs, with rates exceeding 90\% in non-Western contexts such as Arabic and Hindi. These effects hold not only on controlled synthetic datasets but also on real-world social media traces, revealing a serious risk for billions of users. To explain why this happens, we introduce saliency drift attribution (SDA), an interpretability framework that shows how, under code-mixing, the model's internal attention drifts away from safety-critical tokens (e.g., ``violence'' or ``corruption''), effectively blinding it to harmful intent. Finally, we propose a lightweight translation-based restoration strategy that recovers roughly 80\% of the safety lost to code-mixing, offering a practical path toward more equitable and robust LLM safety.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
