LLM卫士：通过第三方对话监督缓解对抗说服
LLM Wardens: Mitigating Adversarial Persuasion with Third-Party Conversational Oversight
AI总结：
研究通过引入第三方LLM卫士模型，降低对抗性LLM对用户的操纵成功率，实验显示卫士模型使对手成功率从65.4%降至30.4%。
摘要：
大型语言模型（LLMs）日益具备说服能力，这引发了如何保护用户免受操纵的问题。在一项预注册用户研究（N=120）中，我们发现具有隐藏目标的对抗性LLM在四个决策场景中成功引导用户决策的频率为65.4%。我们随后引入了“卫士”模型：一个次要LLM，实时监控人类与AI的交互轨迹，并在检测到操纵时向用户发出非约束性、私密的建议。增加卫士模型使对手的成功率超过减半至30.4%，对真实交互的减少幅度更小（8.6个百分点）。为探讨这些结果的机制，我们发布了COAX-Bench模拟基准，涵盖14个决策场景，包括招聘、投票和文件访问。在16,212次模拟多智能体交互中，具备对抗能力的LLMs在34.7%的情况下实现其隐藏目标，而卫士模型将其降至12.3%。值得注意的是，即使卫士模型比其监督的对手弱，也能提供有意义的保护，这表明了一条扩展监控更强大模型的路径。
英文摘要：
LLMs are increasingly capable of persuasion, which raises the question of how to protect users against manipulation. In a preregistered user study (N=120) across four decision-making scenarios, we find that an adversarial LLM with a hidden goal succeeds in steering users' decisions 65.4% of the time. We then introduce a "warden" model: a secondary LLM that monitors the human-AI interaction trace in real time and issues non-binding, private advisories to the user when it detects manipulation. Adding a warden more than halves the adversary's success rate to 30.4%, with a much smaller (8.6 percentage points) reduction for genuine interactions. To probe the mechanism behind these results, we release COAX-Bench, a simulation benchmark spanning 14 decision-making scenarios, including hiring, voting, and file access. Across 16,212 simulated multi-agent interactions, capable adversarial LLMs achieve their hidden goals in 34.7% of cases, which warden models reduce to 12.3%. Notably, even warden models substantially weaker than the adversary they oversee provide meaningful protection, suggesting a path for scalable oversight of more capable models.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
