测试时免疫：一种针对（多模态）大语言模型越狱攻击的通用防御框架
Test-Time Immunization: A Universal Defense Framework Against Jailbreaks for (Multimodal) Large Language Models
AI总结：
提出通用防御框架TIM，通过训练gist token高效检测越狱并结合安全微调与模块解耦，实现LLMs和多模态LLMs对多种越狱攻击的自适应防御。
摘要：
尽管（多模态）大语言模型（LLMs）因其卓越能力而受到广泛关注，但它们仍然容易受到越狱攻击。人们提出了各种防御方法来防御越狱攻击，然而，这些方法通常针对特定类型的越狱攻击定制，限制了它们对抗多样化对抗策略的有效性。例如，基于改写的防御对文本对抗越狱有效，但无法抵消基于图像的攻击。为了克服这些限制，我们提出了一种通用防御框架，称为 Test-time IMmunization (TIM)，它能够以自我进化的方式自适应地防御各种越狱攻击。具体而言，TIM 最初训练一个 gist token 用于高效检测，随后在推理期间应用它来检测越狱活动。当识别出越狱尝试时，TIM 使用检测到的越狱指令配对拒绝回答来实施安全微调。此外，为了缓解安全微调期间参数更新导致的检测器潜在性能下降，我们将微调过程与检测模块解耦。在 LLMs 和多模态 LLMs 上的大量实验证明了 TIM 的有效性。
英文摘要：
While (multimodal) large language models (LLMs) have attracted widespread attention due to their exceptional capabilities, they remain vulnerable to jailbreak attacks. Various defense methods are proposed to defend against jailbreak attacks, however, they are often tailored to specific types of jailbreak attacks, limiting their effectiveness against diverse adversarial strategies. For instance, rephrasing-based defenses are effective against text adversarial jailbreaks but fail to counteract image-based attacks. To overcome these limitations, we propose a universal defense framework, termed Test-time IMmunization (TIM), which can adaptively defend against various jailbreak attacks in a self-evolving way. Specifically, TIM initially trains a gist token for efficient detection, which it subsequently applies to detect jailbreak activities during inference. When jailbreak attempts are identified, TIM implements safety fine-tuning using the detected jailbreak instructions paired with refusal answers. Furthermore, to mitigate potential performance degradation in the detector caused by parameter updates during safety fine-tuning, we decouple the fine-tuning process from the detection module. Extensive experiments on both LLMs and multimodal LLMs demonstrate the efficacy of TIM.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
