NeST: 面向LLM安全的神经元选择性调优
NeST: Neuron Selective Tuning for LLM Safety
AI总结：
提出NeST框架，通过激活探测识别安全相关前馈神经元并训练共享簇级更新，仅用普通恶意提示即可泛化防御多种越狱攻击，在14个模型上以极少参数实现接近全微调的鲁棒性。
摘要：
安全对齐对于大型语言模型（LLM）的负责任部署至关重要。然而，现有方法通常依赖于重量级的微调，这在跨模型家族更新、审计和维护时成本高昂。全微调会产生大量的计算和存储开销，而参数高效方法（如低秩适应LoRA）则牺牲效率换取不一致的安全增益和对设计选择的敏感性。安全干预机制在不修改模型权重的情况下减少不安全输出，但无法直接塑造或保留控制安全行为的内部表示。我们提出NeST，一种用于高效事后安全对齐的神经元选择性调优框架。NeST通过对普通有害和无害提示进行激活探测来识别安全相关的前馈神经元，聚类具有相似激活模式的神经元，并训练共享的簇级更新，同时冻结模型的其余部分。重要的是，NeST仅使用普通恶意提示进行训练，不使用越狱特定的攻击数据，但能稳健地泛化到多种越狱攻击。学习到的更新随后被折叠到原始权重中，不产生推理时开销。在14个开源权重语言和多模态模型上的评估表明，NeST优于轻量级基线，并以显著更少的可训练参数接近全微调的鲁棒性。在纯文本模型上，NeST将平均越狱攻击成功率从44.5%降至1.1%，平均仅训练0.4M参数。在多模态设置中，它将ASR从55.3%降至1.1%，对于下游微调变体，通过将ASR从53.8%降至0.8%来恢复安全性。这些结果表明，通过将适应集中在局部、功能连贯的安全结构上，可以实现鲁棒、可维护的安全对齐。
英文摘要：
Safety alignment is essential for the responsible deployment of Large Language Models (LLMs). Yet, existing approaches often rely on heavyweight fine-tuning that is costly to update, audit, and maintain across model families. Full fine-tuning incurs substantial computational and storage overhead, while parameter-efficient methods, e.g., Low-Rank Adaptation (LoRA), trade efficiency for inconsistent safety gains and sensitivity to design choices. Safety intervention mechanisms reduce unsafe outputs without modifying model weights, but do not directly shape or preserve the internal representations that govern safety behavior. We present NeST, a Neuron-Selective Tuning framework for efficient post-hoc safety alignment. NeST identifies safety-relevant feed-forward neurons via activation probing on vanilla harmful and benign prompts, clusters neurons with similar activation profiles, and trains shared cluster-level updates while freezing the rest of the model. Importantly, NeST is trained only on vanilla malicious prompts, without using jailbreak-specific attack data, yet generalizes robustly to diverse jailbreaks. The learned updates are then folded into the original weights, incurring no inference-time overhead. Evaluated on 14 open-weight language and multimodal models, NeST outperforms lightweight baselines and approaches full fine-tuning robustness with significantly fewer trainable parameters. On text-only models, NeST reduces average jailbreak attack success rate from 44.5% to 1.1% while training only 0.4M parameters on average. Across multimodal settings, it reduces ASR from 55.3% to 1.1%, and for downstream fine-tuned variants, it restores safety by reducing ASR from 53.8% to 0.8%. These results show that robust, maintainable safety alignment can be achieved by concentrating adaptation on localized, functionally coherent safety structures.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
