稀疏自编码器是LLM劫持攻击缓解器
Sparse Autoencoders are Capable LLM Jailbreak Mitigators
AI总结：
本文提出基于SAE的CC-Delta方法，通过比较带有和无劫持上下文的有害请求的token级表示，识别劫持相关的稀疏特征，从而在稀疏SAE特征空间中实现更优的安全-效用权衡。
摘要：
劫持攻击仍然是大语言模型安全性的持续威胁。我们提出上下文条件delta引导（CC-Delta），一种基于SAE的防御方法，通过比较带有和无劫持上下文的有害请求的token级表示，识别劫持相关的稀疏特征。使用配对的有害/劫持提示，CC-Delta通过统计检验选择特征，并在SAE潜在空间中应用推理时的均值位移引导。在四个对齐的指令微调模型和十二种劫持攻击上，CC-Delta在安全-效用权衡上与基于密集潜在空间的基线防御相当或更优。特别是在四个模型上，我们的方法明显优于密集均值位移引导，尤其是在对抗分布攻击中，表明在稀疏SAE特征空间中引导比在密集激活空间中引导在劫持缓解中更具优势。我们的结果表明，为可解释性训练的现成SAE可以被重新利用作为实用的劫持防御，而无需任务特定训练。
英文摘要：
Jailbreak attacks remain a persistent threat to large language model safety. We propose Context-Conditioned Delta Steering (CC-Delta), an SAE-based defense that identifies jailbreak-relevant sparse features by comparing token-level representations of the same harmful request with and without jailbreak context. Using paired harmful/jailbreak prompts, CC-Delta selects features via statistical testing and applies inference-time mean-shift steering in SAE latent space. Across four aligned instruction-tuned models and twelve jailbreak attacks, CC-Delta achieves comparable or better safety-utility tradeoffs than baseline defenses operating in dense latent space. In particular, our method clearly outperforms dense mean-shift steering on all four models, and particularly against out-of-distribution attacks, showing that steering in sparse SAE feature space offers advantages over steering in dense activation space for jailbreak mitigation. Our results suggest off-the-shelf SAEs trained for interpretability can be repurposed as practical jailbreak defenses without task-specific training.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
