通过噪声增强对齐的可证明防御框架对抗LLM劫持
Provable Defense Framework for LLM Jailbreaks via Noise-Augumented Alignment
AI总结：
本文提出通过噪声增强对齐的可证明防御框架，有效降低LLM劫持攻击成功率，提升模型鲁棒性与实用性。
摘要：
大型语言模型（LLMs）仍易受适应性劫持攻击，此类攻击可轻易绕过经验性防御如GCG。我们提出一个可证明鲁棒性的框架，将安全保证从单次推理转移至集合的统计稳定性。我们引入了通过分层随机消解的认证语义平滑（CSS）技术，该技术将输入分为不可变的结构提示和可变的负载，以利用超几何分布推导出严格的lo norm保证。为解决稀疏上下文下的性能下降问题，我们采用噪声增强对齐训练（NAAT），将基础模型转化为语义去噪器。在Llama-3上的大量实验表明，我们的方法将基于梯度的攻击成功率从84.2%降至1.2%，同时保持94.1%的良性实用性，显著优于字符级基线，后者将实用性降至74.3%。该框架提供了一种确定性的安全证书，确保模型在可证明半径内对所有对抗变体保持鲁棒。
英文摘要：
Large Language Models (LLMs) remain vulnerable to adaptive jailbreaks that easily bypass empirical defenses like GCG. We propose a framework for certifiable robustness that shifts safety guarantees from single-pass inference to the statistical stability of an ensemble. We introduce Certified Semantic Smoothing (CSS) via Stratified Randomized Ablation, a technique that partitions inputs into immutable structural prompts and mutable payloads to derive rigorous lo norm guarantees using the Hypergeometric distribution. To resolve performance degradation on sparse contexts, we employ Noise-Augmented Alignment Tuning (NAAT), which transforms the base model into a semantic denoiser. Extensive experiments on Llama-3 show that our method reduces the Attack Success Rate of gradient-based attacks from 84.2% to 1.2% while maintaining 94.1% benign utility, significantly outperforming character-level baselines which degrade utility to 74.3%. This framework provides a deterministic certificate of safety, ensuring that a model remains robust against all adversarial variants within a provable radius.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
