Skin-Deep: 大型语言模型表示中对齐脆弱性的几何诊断方法
Skin-Deep: A Geometric Diagnostic for Alignment Fragility in Large Language Model Representations
AI总结：
提出Skin-Deep几何诊断方法，通过计算几何脆弱性分数（GFS）在对齐模型微调前检测其拒绝有害请求行为的脆弱性，无需运行攻击。
摘要：
对齐调优旨在使模型对有害请求的拒绝变得鲁棒，然而这种安全行为可能会被一小部分良性微调样本所消除。这对于开放权重模型来说是一个部署风险，因为检查点可能在发布时通过拒绝测试，但在低成本下游微调后失去拒绝能力。先前的工作已经确认了这些拒绝失败，但现有研究并未展示如何在运行攻击或微调干预之前检测对齐模型本身的这种脆弱性。我们引入了Skin-Deep，一种几何诊断方法，它直接在运行此类干预之前从对齐模型的隐藏状态激活中检测对齐脆弱性，并将逐层安全几何压缩为单个标量——几何脆弱性分数（GFS）。应用于跨越六种对齐配方和3B-32B参数的21个指令调优模型，Skin-Deep揭示了跨模型家族中反复出现的低秩安全子空间。方向消融表明，移除该子空间中的方向会削弱对有害请求的拒绝，为恢复的几何结构构成拒绝行为的基础提供了因果证据。关键的是，GFS在任何微调之前就能识别出在小型LoRA微调后保留最多拒绝行为的初始安全模型。这些结果确立了GFS作为一种实用的部署前诊断工具，用于标记脆弱的拒绝行为而无需运行攻击。
英文摘要：
Refusal on a safety benchmark does not reveal how stable that behavior will remain after model updates. Benign downstream fine-tuning can weaken refusal, yet behavioral evaluations typically expose this fragility only after an intervention. We introduce SKIN-DEEP, a geometric diagnostic that examines the unmodified model's residual-stream activations. It compares aligned and base checkpoints to identify safety-separating directions, tests their behavioral relevance through ablation, and summarizes the layer-wise pattern in the Geometric Fragility Score (GFS). Across twenty-one instruction-tuned models, harmful requests and benign instructions exhibit a recurring low-rank separation pattern. Selected direction ablations weaken refusal, with the effective direction varying across models. In benign low-rank fine-tuning experiments, the initially safe model with the lowest score before fine-tuning has the lowest harmful-compliance rate when trained on the largest tested set of harmless examples. These findings connect representation geometry to subsequent behavioral susceptibility and support activation-based diagnostics as a complement to refusal tests. Our code is available at https://github.com/js-lee-AI/skin-deep.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
