Reflect-Guard: 通过逻辑自我反思增强大语言模型对对抗性提示的防护
Reflect-Guard: Enhancing LLM Safeguards against Adversarial Prompts via Logical Self-Reflection
AI总结：
提出Reflect-Guard方法，通过参数高效微调为大语言模型安全分类器注入链式思维自我反思能力，显著提升对对抗性越狱攻击的检测性能。
摘要：
大语言模型安全分类器（如Llama Guard）能有效检测明显有害的提示，但对通过角色扮演场景、虚构框架和间接请求伪装恶意意图的对抗性越狱攻击仍然脆弱。我们提出Reflect-Guard，一种通过参数高效微调为大语言模型安全分类器注入链式思维自我反思能力的方法。我们的方法从GPT-4o-mini中提炼分析推理能力，形成结构化反思注释，然后通过QLoRA训练Llama-Guard-3-8B，使其在发布安全判决前生成逻辑自我反思。仅使用1000个训练样本并更新0.5%的模型参数（约4200万），Reflect-Guard在两个具有挑战性的基准测试上取得了显著改进。在WildGuardTest上，F1分数从0.770提升至0.842（+7.2个百分点），对抗性提示的召回率从0.513提升至0.921（+40.8个百分点）。在JailbreakBench上，攻击成功率从10.3%降至1.8%，相对降低82.5%。这些增益在对抗性输入上尤为明显，显式的推理步骤使模型能够看穿击败标准模式匹配方法的混淆技术。我们的结果表明，教会安全分类器推理对抗性意图，而非简单分类表面模式，是实现鲁棒大语言模型安全性的有前景方向。
英文摘要：
Large language model (LLM) safety classifiers such as Llama Guard are effective at detecting overtly harmful prompts but remain vulnerable to adversarial jailbreak attacks that disguise malicious intent through role-play scenarios, fictional framing, and indirect requests. We present Reflect-Guard, a method that augments LLM-based safety classifiers with chain-of-thought self-reflection capabilities through parameter-efficient fine-tuning. Our approach distills analytical reasoning from GPT-4o-mini into structured reflection annotations, then trains Llama-Guard-3-8B via QLoRA to generate logical self-reflections before issuing safety verdicts. Using only 1000 training examples and updating just 0.5% of model parameters (~42M), Reflect-Guard achieves substantial improvements on two challenging benchmarks. On WildGuardTest, F1 score improves from 0.770 to 0.842 (+7.2 pp), with recall on adversarial prompts increasing from 0.513 to 0.921 (+40.8 pp). On JailbreakBench, the attack success rate drops from 10.3% to 1.8%, representing an 82.5% relative reduction. These gains are especially pronounced on adversarial inputs, where the explicit reasoning step enables the model to see through obfuscation techniques that defeat standard pattern-matching approaches. Our results demonstrate that teaching safety classifiers to reason about adversarial intent, rather than simply classify surface patterns, is a promising direction for robust LLM safety.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
