多样性越低，安全性越差：大规模语言模型测试时缩放的间接但广泛的风险
Less Diverse, Less Safe: The Indirect But Pervasive Risk of Test-Time Scaling in Large Language Models
AI总结：
本文揭示了测试时缩放（TTS）中多样性降低导致安全风险增加的问题，提出RefDiv协议用于检测TTS管道中的漏洞，并发现现有安全防护措施对此类风险效果有限。
摘要：
测试时缩放（TTS）通过探索多个候选响应并操作此集合以找到最佳输出来提升LLM推理能力。TTS背后隐含的前提是足够多样化的候选池能提高可靠性。本文表明，TTS中这一假设引入了之前未被识别的失败模式。当候选多样性被限制，即使只是适度减少，TTS更可能产生不安全的输出。我们提出了一种参考引导的多样性减少协议（RefDiv），作为诊断攻击以压力测试TTS管道。通过在开源模型（如Qwen3、Mistral、Llama3.1、Gemma3）和两种常用TTS策略（蒙特卡洛树搜索和Best-of-N）上进行广泛实验，发现限制多样性一致地表示TTS产生不安全结果的速率。其影响通常比直接通过高对抗意图评分的提示生成的更强。观察到的现象也跨TTS策略和闭源模型（如OpenAI o3-mini和Gemini-2.5-Pro）转移，表明这是TTS的普遍属性而非特定模型的产物。此外，我们发现广泛使用的安全防护分类器（如Llama-Guard）无法检测由RefDiv生成的对抗性提示，表明现有防御措施对这种由多样性驱动的失败模式提供有限保护。
英文摘要：
Test-Time Scaling (TTS) improves LLM reasoning by exploring multiple candidate responses and then operating over this set to find the best output. A tacit premise behind TTS is that sufficiently diverse candidate pools enhance reliability. In this work, we show that this assumption in TTS introduces a previously unrecognized failure mode. When candidate diversity is curtailed, even by a modest amount, TTS becomes much more likely to produce unsafe outputs. We present a reference-guided diversity reduction protocol (RefDiv) that serves as a diagnostic attack to stress test TTS pipelines. Through extensive experiments across open-source models (e.g. Qwen3, Mistral, Llama3.1, Gemma3) and two widely used TTS strategies (Monte Carlo Tree Search and Best-of-N), constraining diversity consistently signifies the rate at which TTS produces unsafe results. The effect is often stronger than that produced by prompts directly with high adversarial intent scores. This observed phenomenon also transfers across TTS strategies and to closed-source models (e.g. OpenAI o3-mini and Gemini-2.5-Pro), thus indicating that this is a general and extant property of TTS rather than a model-specific artifact. Additionally, we find that numerous widely used safety guardrail classifiers (e.g. Llama-Guard), are unable to flag the adversarial input prompts generated by RefDiv, demonstrating that existing defenses offer limited protection against this diversity-driven failure mode.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
