追溯性思维链（RetroCoT）：作为跨模型代际安全诊断的法证重建提示
Retroactive Chain-of-Thought (RetroCoT): Forensic Reconstruction Prompts as a Safety Diagnostic Across Model Generations
AI总结：
研究发现大语言模型安全对齐受语用寄存器影响，介绍追溯性思维链攻击RetroCoT将有害请求重构为法证重建任务，在AdvBench测试中取得一定成功率，还发现模型代际差异及新语用寄存器对模型安全对齐的影响。
摘要：
大语言模型中的安全对齐通常是根据直接的、命令式的有害请求进行评估的。我们表明，这种对齐在很大程度上取决于语用寄存器：拒绝直接请求的模型在通过不同的交际立场表达相同的潜在目标时往往会遵守。这表明当前的对齐策略对语义等价性不是不变的，而是对请求的语用框架仍然敏感。我们引入了追溯性思维链（RetroCoT），一种单轮攻击，将有害请求重新构建为法证重建任务。RetroCoT不是直接请求有害指令，而是假定有害结果已经发生，并要求作为法证分析师的模型反向重建产生该结果的因果链。在AdvBench（n = 50）上，RetroCoT在gpt - 4o上的攻击成功率为58%，在gpt - 4o - mini上为52%，而直接请求基线分别为0%和4%。我们进一步发现了一个明显的代际差距：GPT - 5系列模型完全拒绝RetroCoT，在其拒绝理由中明确指出重建前提，这与对这种重建寄存器的明确覆盖一致。然而，这种稳健性并不能跨语用形式推广。在GPT - 5.4 - mini上，一个单一的对抗性反馈轮次，将现有的法证重建响应与评估者的批评一起呈现，将攻击成功率从0%提高到48%，在GPT - 4o上从58%提高到94%；一个省略了伪造低分的控制条件在GPT - 5.4 - mini上达到了85%，这表明起作用的因素是在既定的法证框架内的语用延续，而不是分数操纵。这些结果表明，前沿模型的对齐仍然取决于语用框架而不是语义意图，并且新的语用寄存器可以继续暴露一个……
英文摘要：
Safety alignment in large language models is typically evaluated against direct, imperative harmful requests. We show that this alignment is highly conditioned on pragmatic register: models that refuse a direct request frequently comply when the same underlying objective is expressed through a different communicative stance. This suggests that current alignment policies are not invariant to semantic equivalence, but remain sensitive to how a request is pragmatically framed. We introduce Retroactive Chain-of-Thought (RetroCoT), a single-turn attack that reframes harmful requests as forensic reconstruction tasks. Rather than requesting harmful instructions directly, RetroCoT presupposes that the harmful outcome has already occurred and asks the model, acting as a forensic analyst, to reconstruct in reverse the causal chain that produced it. On AdvBench (n=50), RetroCoT achieves attach success rate of 58% on gpt-4o and 52% on gpt-4o-mini, compared with direct-request baselines of 0% and 4%, respectively. We further identify a pronounced generation gap: GPT-5-family models refuse RetroCoT entirely, explicitly identifying the reconstruction premise in their refusal rationales, consistent with explicit coverage of this reconstruction register. However, this robustness does not generalize across pragmatic forms. A single adversarial feedback turn presenting an existing forensic reconstruction response alongside evaluator critique raises ASR from 0% to 48% on GPT-5.4-mini and from 58% to 94% on GPT-4o; a control condition omitting the fabricated low score achieves 85% on GPT-5.4-mini, indicating that the operative element is pragmatic continuation within the established forensic frame rather than score manipulation. These results suggest that frontier-model alignment remains conditioned on pragmatic framing rather than semantic intent, and that new pragmatic registers can continue to expose a...
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
