arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2602.08377cs.LGcs.AIcs.CL
收藏

具有回溯反馈的强化学习

Reinforcement Learning with Backtracking Feedback

Google(谷歌);Google DeepMind(谷歌DeepMind);Virginia Tech(弗吉尼亚理工大学)

Bilgehan Sel, Vaishakh Keshava, Phillip Wallis, Lukas Rutishauser, Ming Jin, Dingcheng Li

AI总结:

本文提出RLBF框架,通过强化学习阶段使模型动态纠正生成错误,结合改进的SFT数据生成策略,提升LLM在对抗攻击和内在错误中的安全性。

摘要:

为应对大型语言模型(LLM)在对抗攻击和内在错误中的安全需求,我们引入了具有回溯反馈的强化学习(RLBF)。该框架在先前方法如BSAFE基础上,主要利用强化学习阶段,使模型学习动态纠正自身生成错误。通过基于模型实时输出的批评反馈,LLM被训练识别并从实际涌现的安全违规中恢复,通过发出高效的'回溯x个token'信号,然后继续自回归生成。此强化学习过程对于增强对复杂对抗策略的鲁棒性至关重要,包括中间填充、贪心坐标梯度(GCG)攻击和解码参数操控。为进一步支持获取回溯能力,我们还提出了改进的监督微调(SFT)数据生成策略(BSAFE+)。该方法通过在连贯且原本安全的文本中注入违规,改进了先前的数据创建技术,为回溯机制提供更有效的初始训练。全面的实证评估显示,RLBF显著降低了攻击成功率,无论在多样化的基准和模型规模上均取得优越的安全性能,同时在关键上保持基础模型的实用性。

英文摘要:

Addressing the critical need for robust safety in Large Language Models (LLMs), particularly against adversarial attacks and in-distribution errors, we introduce Reinforcement Learning with Backtracking Feedback (RLBF). This framework advances upon prior methods, such as BSAFE, by primarily leveraging a Reinforcement Learning (RL) stage where models learn to dynamically correct their own generation errors. Through RL with critic feedback on the model's live outputs, LLMs are trained to identify and recover from their actual, emergent safety violations by emitting an efficient "backtrack by x tokens" signal, then continuing generation autoregressively. This RL process is crucial for instilling resilience against sophisticated adversarial strategies, including middle filling, Greedy Coordinate Gradient (GCG) attacks, and decoding parameter manipulations. To further support the acquisition of this backtracking capability, we also propose an enhanced Supervised Fine-Tuning (SFT) data generation strategy (BSAFE+). This method improves upon previous data creation techniques by injecting violations into coherent, originally safe text, providing more effective initial training for the backtracking mechanism. Comprehensive empirical evaluations demonstrate that RLBF significantly reduces attack success rates across diverse benchmarks and model scales, achieving superior safety outcomes while critically preserving foundational model utility.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑