主动适应，而非静态防御：对抗性微调中预防性引导的时间动态
Active Adaptation, Not Static Defense: Temporal Dynamics of Preventative Steering in Adversarial Fine-Tuning
浏览论文内容
中文总结 AI 辅助
本文通过分析预防性引导的时间动态，发现其依赖主动适应而非静态防御，并提出渐进强度调度（PIS）方法，在Qwen2.5和Gemma-3模型上提升安全鲁棒性并减少有害特质表达。
中文摘要 AI 辅助
大型语言模型在面对恶意微调时仍然脆弱，这促使研究者开发针对有害人格漂移的训练时防御方法。预防性引导（Preventative Steering）在微调期间注入不良特质的人格向量，并在评估时移除它们，然而其持久保护背后的机制仍不清楚。通过分析其时间优化动态，我们发现该防御源于一个早期的补偿性适应阶段，随后进入一个稳态阶段，在此阶段纠正信号衰减；在参数空间中，注意力输出投影成为防御性更新的主要残差写入路径。通过干预增量保留（Intervention Delta Preservation, IDP）和IDP延续实验，我们进一步表明，保留或重新注入权重偏移无法维持保护，这表明预防性引导依赖于主动适应而非静态防御。受此发现启发，我们提出了渐进强度调度（Progressive Intensity Scheduling, PIS），该方法从适中的注入强度开始，并在静态强度对齐开始衰减后增加强度。在评估的Qwen2.5和Gemma-3模型中，PIS相比静态强度引导提高了安全鲁棒性，同时减少了有害特质表达。
英文摘要
Large language models remain fragile against malicious fine-tuning, motivating training-time defenses against harmful persona drift. Preventative Steering injects undesirable-trait persona vectors during fine-tuning and removes them at evaluation time, yet the mechanism behind its lasting protection remains unclear. Analyzing its temporal optimization dynamics, we find that the defense emerges from an early compensatory adaptation phase followed by a steady-state phase where the corrective signal decays; in parameter space, attention output projections emerge as the dominant residual-write route for defensive updates. Through Intervention Delta Preservation (IDP) and IDP Continuation experiments, we further show that preserving or reinjecting the weight offset fails to maintain protection, indicating that preventative steering relies on active adaptation rather than a static defense. Motivated by this finding, we propose Progressive Intensity Scheduling (PIS), which starts with a moderate injection strength and increases it after static-strength alignment begins to decay. Across the evaluated Qwen2.5 and Gemma-3 models, PIS improves safety robustness over static-strength steering while reducing harmful trait expression.
发表机构
- JIUTIAN Research（中移九天）
- Beijing University of Posts and Telecommunications（北京邮电大学）
机构由 AI 辅助整理，请以论文原文为准。
