LLM-VA: 通过向量对齐解决对抗性回应与过度拒绝的权衡
LLM-VA: Resolving the Jailbreak-Overrefusal Trade-off via Vector Alignment
AI总结：
LLM-VA通过向量对齐解决大型语言模型在对抗性回应与过度拒绝间的权衡问题，提升安全性和效用。
摘要：
安全对齐的大型语言模型面临两种失败模式：对抗性回应（回答有害输入）和过度拒绝（拒绝良性查询）。现有向量引导方法调整答案向量的幅度，但这种方法导致根本性的权衡——减少对抗性回应会增加过度拒绝，反之亦然。我们发现根本原因：LLM将回答的决策（答案向量va）和输入安全性的判断（良性向量vb）编码为几乎正交的方向，将其视为独立过程。我们提出了LLM-VA，通过闭合形式的权重更新对va和vb进行对齐，使模型的回应意愿因果依赖于其安全性评估——无需微调或架构更改。我们的方法在每一层使用支持向量机识别向量，选择安全性相关的层，并通过最小范数权重修改迭代对齐向量。在12个LLM上的实验表明，LLM-VA在保持95.92%的效用的同时，比最佳基线高出11.45%的F1值，并能自动适应每个模型的安全性偏见，而无需手动调整。代码和模型可在https://hotbento.github.io/LLM-VA-Web/上获得。
英文摘要：
Safety-aligned LLMs suffer from two failure modes: jailbreak (answering harmful inputs) and over-refusal (declining benign queries). Existing vector steering methods adjust the magnitude of answer vectors, but this creates a fundamental trade-off -- reducing jailbreak increases over-refusal and vice versa. We identify the root cause: LLMs encode the decision to answer (answer vector $v_a$) and the judgment of input safety (benign vector $v_b$) as nearly orthogonal directions, treating them as independent processes. We propose LLM-VA, which aligns $v_a$ with $v_b$ through closed-form weight updates, making the model's willingness to answer causally dependent on its safety assessment -- without fine-tuning or architectural changes. Our method identifies vectors at each layer using SVMs, selects safety-relevant layers, and iteratively aligns vectors via minimum-norm weight modifications. Experiments on 12 LLMs demonstrate that LLM-VA achieves 11.45% higher F1 than the best baseline while preserving 95.92% utility, and automatically adapts to each model's safety bias without manual tuning. Code and models are available at https://hotbento.github.io/LLM-VA-Web/.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
