JPU: 通过在线策略路径校正弥合对抗防御与遗忘
JPU: Bridging Jailbreak Defense and Unlearning via On-Policy Path Rectification
AI总结：
JPU通过动态挖掘在线策略对抗样本，校正动态对抗路径以提升模型对抗攻击的鲁棒性。
摘要：
尽管广泛的安全对齐，大型语言模型（LLMs）往往在对抗攻击面前失败。虽然机器遗忘已作为一种有前途的防御方法通过删除特定有害参数出现，但当前方法仍然容易受到多种对抗攻击。我们首先进行实证研究，发现这种失败机制是由对抗攻击主要激活中间层中未删除的参数引起的。进一步，通过探测这些绕过参数如何重新组合成被禁止输出的底层机制，我们验证了动态对抗路径的持续存在，并表明无法校正这些路径是现有遗忘防御的根本差距。为弥合这一差距，我们提出了Jailbreak Path Unlearning（JPU），这是首个通过动态挖掘在线策略对抗样本来校正动态对抗路径，以安全锚点为目标的方法。广泛实验表明，JPU显著增强了对动态攻击的抵抗力，同时保持了模型的效用。
英文摘要：
Despite extensive safety alignment, Large Language Models (LLMs) often fail against jailbreak attacks. While machine unlearning has emerged as a promising defense by erasing specific harmful parameters, current methods remain vulnerable to diverse jailbreaks. We first conduct an empirical study and discover that this failure mechanism is caused by jailbreaks primarily activating non-erased parameters in the intermediate layers. Further, by probing the underlying mechanism through which these circumvented parameters reassemble into the prohibited output, we verify the persistent existence of dynamic $\textbf{jailbreak paths}$ and show that the inability to rectify them constitutes the fundamental gap in existing unlearning defenses. To bridge this gap, we propose $\textbf{J}$ailbreak $\textbf{P}$ath $\textbf{U}$nlearning (JPU), which is the first to rectify dynamic jailbreak paths towards safety anchors by dynamically mining on-policy adversarial samples to expose vulnerabilities and identify jailbreak paths. Extensive experiments demonstrate that JPU significantly enhances jailbreak resistance against dynamic attacks while preserving the model's utility.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
