发表机构
RIKEN AIP; Institute of Science Tokyo; Zhejiang University（理化学研究所先进智能项目; 东京科学大学; 浙江大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
该研究针对合并模型家族提出BAJ方法，利用预训练基础模型的越狱风险，通过最小-最大优化生成可迁移的对抗性后缀，在多种设置下均实现高迁移成功率且能抵御现有防御。
AI 中文摘要
模型合并无需额外训练即可组合多个微调模型，但其安全影响仍鲜为人知。过往研究主要将合并风险归因于不安全的组成模型，隐含假设是合并各自经过安全对齐的模型可保持安全性。与此相反，我们证明模型合并会揭示一种此前被忽视的越狱风险，该风险源于预训练基础模型，即便所有组成模型各自经过安全对齐也会存在。基于此观察，我们研究了一种新的威胁场景：攻击者构造的越狱提示词可在共享同一预训练主干的合并模型间泛化，且无需获取确切的合并系数或组成模型检查点。为利用该现象，我们提出了感知 Basin 越狱攻击（Basin-Aware Jailbreak，BAJ），其将越狱生成建模为合并空间上的最小-最大优化，以生成可在合并模型家族间迁移的对抗性后缀。在不同主干和合并设置下开展的实验显示，BAJ 始终实现较高的迁移成功率，且在现有防御措施下仍有效。
英文摘要
Model merging enables combining multiple fine-tuned models without additional training, but its safety implications remain poorly understood. Prior work primarily attributes merging risks to unsafe constituent models, implicitly assuming that merging individually aligned models preserves safety. In contrast, we show that model merging reveals a previously overlooked jailbreak risk rooted in the pretrained foundation model, even when all constituent models are individually safety-aligned. Motivated by this observation, we study a new threat setting where an attacker constructs jailbreak prompts that generalize across merged models sharing the same pretrained backbone, without access to the exact merging coefficients or constituent checkpoints. To exploit this phenomenon, we propose \textbf{Basin-Aware Jailbreak (BAJ)}, which formulates jailbreak generation as a min--max optimization over the merging space to produce transferable adversarial suffixes across merged model families. Experiments across diverse backbones and merging settings show that BAJ achieves consistently high transfer success rates and remains effective under existing defenses.
CommentsAccepted by EMNLP findings 2026
