一步之遥：为什么针对恶意微调的防御在自适应对手面前失败
A Few Steps Further: Why Defenses Against Malicious Finetuning Erode Under Continued Training
AI总结：
本文通过分析15种近期防御机制，发现它们共享一个弱点：仅掩盖或误导有害行为路径而未消除行为本身，并开发了一种统一的自适应攻击，成功突破了所有防御机制。
摘要：
模型提供商越来越多地发布开放权重或允许用户通过API微调基础模型。尽管这些模型在发布前经过安全对齐，但其防护措施通常可以通过对有害数据的微调来移除。最近的防御旨在使模型对此类恶意微调具有鲁棒性，但它们主要仅针对不考虑防御的固定攻击进行评估。我们表明这些鲁棒性声明是不完整的。通过调查15种近期防御，我们识别了几种防御机制，并表明它们共享一个单一弱点：它们掩盖或误导通往有害行为的路径，而不移除行为本身。然后，我们开发了一种统一的自适应攻击，突破了所有防御机制。我们的结果表明，当前方法并未提供稳健的安全性；它们主要阻止了它们所设计的攻击。我们希望我们针对这一领域的统一自适应对手将帮助未来的研究人员和实践者在部署前对新防御进行压力测试。
英文摘要：
Model providers increasingly release the weights of large language models. Although these models are safety-aligned before release, their safeguards can often be removed by fine-tuning on harmful data. A growing class of defenses aims to make alignment robust to such malicious fine-tuning, but these defenses are typically evaluated against attacks with a fixed training budget, even though an attacker who holds the weights can simply train for longer. We ask whether current defenses withstand this simplest escalation. Surveying fifteen recent defenses, we find that they share a common weakness: each is built around a limited model of the attacker, such as a bounded perturbation, a short simulated attack, or a trained link between harmful and benign behavior, and nothing enforces that protection once the weights are released. We then test six representative defenses on four open-weight models by continuing the same harmful-only fine-tuning attack for three epochs and measuring harmfulness and capability along the way. In all 72 defended runs, the model is more harmful at the end of training than at release, and on Llama-3.1 at the highest learning rate the defended models end almost as harmful as the undefended one. The defenses are not equally weak: one defense kept harmfulness low on one model, and some attacks recovered harmfulness only at the cost of general capability. Current defenses can delay or disrupt malicious fine-tuning, but in most cases their measured resistance does not persist under continued training, and they should not yet be treated as durable protection.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
