最小、局部、因果解释用于大语言模型中的对抗成功
Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Models
AI总结：
本文研究了大语言模型对抗成功的因果机制，提出LOCA方法通过局部解释识别最小的中间表示变化，以解释对抗成功的原因。
摘要：
经过安全训练的大语言模型（LLMs）常常可以通过对抗提示来回答有害请求。由于我们缺乏对LLMs为何容易受到对抗攻击的深入理解，未来在更高风险环境中自主操作的前沿模型可能同样面临此类攻击。先前的研究通过分析模型的中间表示，识别出在该空间中编码如有害性和拒绝等概念的方向。然后，他们将所有对抗攻击全局解释为试图减少或加强这些概念（例如减少有害性）。然而，不同的对抗策略可能通过加强或抑制不同的中间概念而成功，且同一种对抗策略可能对不同的有害请求类别（例如暴力 vs. 网络攻击）效果不同；因此，我们寻求提供局部解释——即为什么这种特定的对抗成功？为了解决这一差距，我们引入LOCA，一种通过识别一组可解释的中间表示变化来提供局部、因果解释的对抗成功方法。我们评估了LOCA在Gemma和Llama聊天模型上的有害原始对抗配对，与先前方法进行比较。LOCA能够通过平均六次可解释的变化成功诱导拒绝；而先前的工作在20次变化后仍无法实现拒绝。LOCA是大语言模型对抗成功机制性、局部解释的一步。代码将发布。
英文摘要：
Safety trained large language models (LLMs) can often be induced to answer harmful requests through jailbreak prompts. Because we lack a robust understanding of why LLMs are susceptible to jailbreaks, future frontier models operating more autonomously in higher-stakes settings may similarly be vulnerable to such attacks. Prior work has studied jailbreak success by examining the model's intermediate representations, identifying directions in this space that causally encode concepts like harmfulness and refusal. Then, they globally explain all jailbreak attacks as attempting to reduce or strengthen these concepts (e.g., reduce harmfulness). However, different jailbreak strategies may succeed by strengthening or suppressing different intermediate concepts, and the same jailbreak strategy may not work for different harmful request categories (e.g., violence vs. cyberattack); thus, we seek to give a local explanation -- i.e., why did this specific jailbreak succeed? To address this gap, we introduce LOCA, a method that gives Local, CAusal explanations of jailbreak success by identifying a minimal set of interpretable, intermediate representation changes that causally induce model refusal on an otherwise successful jailbreak request. We evaluate LOCA on harmful original-jailbreak pairs from a large jailbreak benchmark across Gemma, Llama, and Qwen chat models, comparing against prior methods adapted to this setting. LOCA can successfully induce refusal by making, on average, six interpretable changes; prior work routinely fails to achieve refusal even after 20 changes. LOCA is a step toward mechanistic, local explanations of jailbreak success in LLMs. Code publicly available at https://github.com/skumar-ml/loca-jailbreaks
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
