arXiv 2606.080442026-06cs.LGcs.AIcs.CL

当行为安全评估失败时：表征层面的视角

When Behavioral Safety Evaluation Fails: A Representation-Level Perspective

Stanford University（斯坦福大学）；University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）；Technical University of Denmark（丹麦技术大学）

Enyi Jiang, Anders Gjølbye, Yibo Jacky Zhang, Sanmi Koyejo

备注：: Preprint

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文提出行为安全与干预鲁棒性之间的“审计差距”，通过构建解离模型和引入潜在脆弱性评分（LVS），证明行为安全指标不足以衡量表征层面的鲁棒性。

摘要：

大型语言模型（LLM）的安全性通常从行为层面进行评估，这提供了有限的内部鲁棒性证据，因为这些评估针对的是输出，而非干预下的表征层面脆弱性。我们将这种差异形式化为审计差距：行为安全与干预下鲁棒性之间的差异。为了研究这一差距，我们构建了解离模型，这些模型在保持安全的外在行为的同时，在潜在空间中仍然脆弱。我们引入了一个基于干预的评估框架，通过在参数和潜在空间中进行软干预（包括有害微调和逐层潜在扰动）来测试模型鲁棒性。为了形式化评估，我们提出了潜在脆弱性评分（LVS），用于衡量通过有界潜在扰动引发有害行为的难易程度。使用该评估框架，我们表明行为安全指标不足以衡量多个安全和对齐及未对齐的最先进模型的表征层面鲁棒性。值得注意的是，解离模型在有害干预下尽管表现出相当的拒绝行为，但LVS显著升高，其中中间表征对干预最为敏感。我们的结果表明，仅凭行为安全评估无法全面反映模型鲁棒性，这促使我们需要进行表征感知的审计，以评估潜在脆弱性和可观察行为。

英文摘要：

Safety evaluation of large language models (LLMs) is largely behavioral: a model is certified safe when it refuses harmful requests and answers benign ones. But refusing on the prompts an auditor happens to try does not show that the model is far from harmful behavior. Behavioral tests observe outputs; they do not measure how easily an intervention on the model turns a refusal into compliance. We call the gap between what static audits certify and what an intervention can reach the audit gap, and we show it is realizable: one can build a model that matches its safety-aligned base on every static audit yet gives way to a small, known perturbation of its internal state. We construct such dissociated models from three safety-aligned bases (Gemma 2 2B, Llama 3.2 3B, Qwen 2.5 3B) and audit the base, dissociated, and openly harmful models with the same soft interventions in parameter and latent space; the latent attacks are summarized by the Latent Vulnerability Score (LVS), the safety degradation produced per unit of bounded latent perturbation. Every static audit we run gives the dissociated model the same verdict as its base, since its refusals match the base, jailbreaks show no consistent signature, and a strong fixed probe on clean activations cannot tell it from the base. The same interventions an auditor could run reverse the verdict. At the targeted mid layer the dissociated models score 2.5 to 3.1 times higher LVS than their bases. A bounded latent attack elicits harmful compliance on 54 to 86% of prompts, against 3 to 48% for the bases, while matched random perturbations stay at or below 12%. Harmful fine-tuning reaches high compliance within five gradient steps, where the bases need 10 to 25. Behavioral testing, even with static latent probing, cannot certify representation-level robustness: a safety audit must intervene on the model, not only observe it.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

AI总结：

摘要：

英文摘要：

相关论文