诱饵与恢复：毒化内部拒答信号以防御大语言模型遭受白盒编辑越狱
Bait-and-Recover: Poisoning Internal Refusal Signals to Defend LLMs against White-Box Editing Jailbreaks
浏览论文内容
中文总结 AI 辅助
提出诱饵与恢复防御方法，通过毒化残差信号破坏白盒编辑越狱的测量假设，将最低拒答率从16.25%提升至71.75%。
中文摘要 AI 辅助
开放权重大型语言模型面临来自表征工程攻击的低成本白盒威胁。攻击者能够估计拒答方向，并搜索抑制安全对齐同时保留通用能力的投影矩阵编辑，整个过程在单块GPU上仅需数分钟，且无需基于梯度的训练。我们提出“诱饵与恢复”（Bait-and-Recover），这是一种权重级防御方法，在攻击者读取激活值的位置放置一个诱饵适配器，并在后续层放置一个配对的恢复适配器。通过梯度路由进行训练，该方法将观测路径与行为路径解耦。通过主动毒化用于测量的残差信号，“诱饵与恢复”破坏了攻击者的编辑搜索，而恢复层则还原干净的下游计算。在四个开放权重模型上，我们的防御在严格的行为保持预算（KL <= 0.10）下，将针对白盒编辑搜索的最低拒答率从16.25%提升至71.75%，且对通用基准的影响可忽略不计。通过使这些攻击的核心测量假设失效，观测路径毒化为行为层面的安全训练提供了一种实用的补充。
英文摘要
Open-weight large language models face a low-cost white-box threat from representation engineering attacks. Attackers can estimate refusal directions and search for projection-matrix edits that suppress safety alignment while preserving general capabilities, within minutes on a single GPU and without gradient-based training. We propose Bait-and-Recover, a weight-level defense that places a bait adapter where attackers read activations and a paired recovery adapter at the subsequent layer. Trained via gradient routing, this decouples the observation path from the behavior path. By actively poisoning the residual signal used for measurement, Bait-and-Recover disrupts the attacker's edit search, while the recovery layer restores clean downstream computation. Across four open-weight models, our defense raises the minimum refusal rate against white-box edit searches from 16.25% to 71.75% under a strict behavior-preservation budget (KL <= 0.10), with negligible impact on general benchmarks. By invalidating the core measurement assumption of these attacks, observation-path poisoning offers a practical complement to behavior-level safety training.
发表机构
- Anhui Laboratory for Safe Artificial Intelligence in the Yangtze River Delta（长三角安徽安全人工智能实验室）
- iFlytek Research（讯飞研究院）
机构由 AI 辅助整理，请以论文原文为准。
