检索增强防御：针对大语言模型的自适应且可控制的越狱防范
Retrieval-Augmented Defense: Adaptive and Controllable Jailbreak Prevention for Large Language Models
AI总结：
针对大语言模型越狱攻击的挑战，提出检索增强防御（RAD）框架，在StrongREJECT数据集上验证其可降低强力越狱攻击有效性，同时平衡安全性与实用性。
摘要：
大语言模型（LLMs）仍易受越狱攻击，此类攻击试图诱导LLMs产生有害响应。这些攻击的演变特性与多样性给防御系统带来诸多挑战，包括：（1）无需昂贵的再训练即可适配新兴攻击策略；（2）控制安全性与实用性之间的权衡。为应对这些挑战，我们提出检索增强防御（Retrieval-Augmented Defense，RAD），这是一种用于越狱检测的新型框架，它将已知攻击示例的数据库融入检索增强生成（Retrieval-Augmented Generation），用于推断攻击系统的潜在恶意用户查询及越狱策略。RAD支持对新发现的越狱策略进行无训练更新，并提供平衡安全性与实用性的机制。在StrongREJECT数据集上开展的实验表明，RAD大幅降低了PAP、PAIR等强力越狱攻击的有效性，同时对良性查询保持较低的弃权（不执行）率。我们提出一种新型评估方案，结果显示RAD可在一系列操作点上以可控方式实现稳健的安全性-实用性权衡。
英文摘要：
Large Language Models (LLMs) remain vulnerable to jailbreak attacks, which attempt to elicit harmful responses from LLMs. The evolving nature and diversity of these attacks pose many challenges for defense systems, including (1) adaptation to counter emerging attack strategies without costly retraining, and (2) control of the trade-off between safety and utility. To address these challenges, we propose Retrieval-Augmented Defense (RAD), a novel framework for jailbreak detection that incorporates a database of known attack examples into Retrieval-Augmented Generation, which is used to infer the underlying, malicious user query and jailbreak strategy used to attack the system. RAD enables training-free updates for newly discovered jailbreak strategies and provides a mechanism to balance safety and utility. Experiments on StrongREJECT show that RAD substantially reduces the effectiveness of strong jailbreak attacks such as PAP and PAIR while maintaining low rejection rates for benign queries. We propose a novel evaluation scheme and show that RAD achieves a robust safety-utility trade-off across a range of operating points in a controllable manner.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
