NeuroArmor：基于安全变体引导的表示一致性实现越狱防御中的选择性重新锚定
NeuroArmor: Safe-Variant-Guided Representation Consistency for Selective Re-Anchoring in Jailbreak Defense
AI总结：
提出NeuroArmor白盒运行时防御方法，通过为每个提示构建安全变体作为局部安全参考，在隐藏状态空间进行一致性检查并路由异常，有效降低恶意攻击成功率同时保持低误报率。
摘要：
大型语言模型仍然容易受到越狱攻击，这些攻击将有害意图隐藏在看似普通的请求背后，例如角色扮演、翻译、编码、对抗性后缀和多轮铺垫。现有的防御方法仍然难以在不过度拦截良性但敏感的请求的情况下处理这些攻击，部分原因是它们通常对每个提示应用相同的操作，因此无法平衡安全性和有用性。我们提出NeuroArmor，一种白盒运行时防御方法，它使用提示特定的安全变体作为局部安全参考，用于决定何时需要干预，并在触发时作为干预的安全目标。对于每个提示，NeuroArmor构建K个安全变体，在隐藏状态空间中将提示状态与此局部安全参考进行比较，并将异常路由到恶意提示的拒绝分支或边界良性提示的有用恢复分支。在Llama-3-8B-Instruct上，NeuroArmor将恶意攻击成功率（ASR）从41.56%降低到1.57%，同时将共享良性池上的良性误报率（FPR）从30.26%降低到22.05%；匹配的基线在此权衡上仍然明显较弱。外部评估者和手动行为评估进一步表明，剩余未拦截的输出产生操作危害的可能性大大降低。总体而言，NeuroArmor通过结合提示特定的一致性检查、路由和选择性干预，为越狱防御提供了更有效的运行时策略。
英文摘要：
Large language models remain vulnerable to jailbreak attacks that hide harmful intent behind seemingly ordinary requests such as role-play, translation, encoding, adversarial suffixes, and multi-turn buildup. Existing defenses still struggle to handle these attacks without over-blocking benign but sensitive requests, partly because they often apply the same action to every prompt and therefore fail to balance safety and helpfulness. We propose NeuroArmor, a white-box runtime defense that uses prompt-specific safe variants as a local safety reference for deciding when intervention is needed and, once triggered, as safe targets for intervention. For each prompt, NeuroArmor builds K safe variants, compares the prompt state against this local safe reference in hidden-state space, and routes anomalies either to a refusal branch for malicious prompts or to a helpful recovery branch for borderline benign prompts. On Llama-3-8B-Instruct, NeuroArmor reduces malicious attack success rate (ASR) from 41.56% to 1.57% while lowering benign false positive rate (FPR) on the shared benign pool from 30.26% to 22.05%; matched baselines remain substantially weaker on this trade-off. External-judge and manual behavioral evaluations further show that the remaining non-blocked outputs are much less likely to be operationally harmful. Overall, NeuroArmor provides a more effective runtime strategy for jailbreak defense by combining prompt-specific consistency checking, routing, and selective intervention.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
