通过精炼的安全目标嵌入利用
Safety Targeted Embedding Exploit via Refinement
AI总结：
提出STEER方法，通过梯度引导攻击识别并翻译关键词语到低资源语言，抑制大语言模型拒绝行为，在多个模型上实现高达96.7%的攻击成功率，揭示安全机制在多语言输入下的泛化缺陷。
摘要：
大语言模型的安全训练主要以英语进行，导致安全机制在低资源语言和混合语言代码切换下的泛化能力不确定。我们表明这造成了认知差距，模型对超出安全训练分布的输入会自信地生成有害响应。为研究此现象，我们引入STEER（通过精炼的安全目标嵌入利用），一种梯度引导的攻击方法，识别对模型拒绝行为贡献最大的词语，并迭代将其翻译成低资源语言以抑制拒绝同时保留有害意图。在六个开源8B参数模型上，STEER在JailbreakBench上达到高达93.0%的攻击成功率，在AdvBench上达到96.7%，优于随机代码切换和贪婪坐标梯度（GCG）。生成的提示也能迁移到GPT-4o-mini，无需访问目标模型即可达到35.5%的攻击成功率，表明潜在弱点并非特定于单一架构。这些发现表明，主要基于英语对齐的安全机制不能假设在多语言输入上泛化。我们认为，改进多语言安全性需要在对齐期间提供更广泛的覆盖，以及明确检测并弃权处理分布外输入的机制。
英文摘要：
Safety training for large language models (LLMs) is conducted predominantly in English, leaving uncertain how well safety mechanisms generalize to low-resource languages and mixed-language code-switching. We show that this creates an epistemic gap in which models confidently generate harmful responses for inputs that fall outside the distribution of their safety training. To study this phenomenon, we introduce STEER (Safety Targeted Embedding Exploit via Refinement), a gradient-guided attack that identifies words contributing most strongly to the model's refusal behavior and iteratively translates them into low-resource languages to suppress refusal while preserving harmful intent. Across six open-source 8B-parameter models, STEER achieves attack success rates of up to 93.0% on JailbreakBench and 96.7% on AdvBench, outperforming random code-switching and Greedy Coordinate Gradient (GCG). The resulting prompts also transfer to GPT-4o-mini, achieving a 35.5% attack success rate without requiring access to the target model, suggesting that the underlying weakness is not specific to a single architecture. These findings demonstrate that safety mechanisms aligned primarily on English cannot be assumed to generalize across multilingual inputs. We argue that improving multilingual safety requires broader coverage during alignment and mechanisms that explicitly detect and abstain on out-of-distribution inputs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
