跳转至

文章背景与核心概要

在大语言模型（LLMs）的安全性研究中，如何有效抵御越狱攻击同时最大程度保留模型自身的通用能力（Utility），一直是学术界和工业界的核心挑战。传统的防御方法往往需要在安全性与模型实用性之间做出沉重的权衡，或者因为“全时开启（always-on）”机制而误伤正常提示词，甚至损害对标准模型性能至关重要的神经元。

为了突破这些局限，本文提出了 Tripwire——一种无需训练的新型防御机制。该机制通过错误发现率（false-discovery-rate）控制下的逐神经元假设检验和效用特异性过滤器，精准识别出安全专用神经元。当检测到攻击时，Tripwire 采用触发式钳制（trigger-style clamp），将所选神经元保持在其有害条件均值激活状态，从而注入内部信号，可靠地触发模型在对齐训练中习得的拒绝行为。该机制可通过“检测器门控的推理时干预”或“离线偏置补丁权重修改”这两种可证明等效的部署模式来实现。实验表明，Tripwire 将平均攻击成功率（ASR）降至最高 2.0%，同时在 MT-Bench 上的效用下降仅为 0.5% 至 5.3%，显著优于现有基准方法。

Tripwire: Triggering Aligned Refusal via Statistically Certified Safety Neurons

Tripwire：通过统计认证的安全神经元触发对齐拒绝机制

arXiv: arXiv:2608.14392 [cs.AI]
Authors: Wei Zhao, Zhe Li, Peixin Zhang, Jun Sun
Submitted: August 14, 2026
Primary Subject: Artificial Intelligence (cs.AI)
Links: View PDF | TeX Source | GitHub Repository

arXiv: arXiv:2608.14392 [cs.AI]
Authors: Wei Zhao, Zhe Li, Peixin Zhang, Jun Sun
Submitted: August 14, 2026
Primary Subject: Artificial Intelligence (cs.AI)
Links: View PDF | TeX Source | GitHub Repository

Summary

摘要与核心总结

Tripwire is a novel, training-free defense mechanism designed to protect Large Language Models (LLMs) against jailbreak attacks via neuron-level interventions. Traditional defenses often suffer from high utility trade-offs, disrupt benign prompts due to being "always-on," or compromise neurons essential for standard model performance.

Tripwire 是一种新颖的、无需训练的防御机制，旨在通过神经元级别的干预来保护大语言模型（LLMs）免受越狱攻击。传统的防御方法往往面临巨大的效用折衷（utility trade-offs），由于采用“全时开启（always-on）”策略而干扰良性提示词，或者破坏了标准模型性能不可或缺的神经元。

Tripwire solves these limitations through the following approach: 1. Certified Identification: Identifies safety-specific neurons using per-neuron hypothesis tests under false-discovery-rate control paired with a utility-specificity filter. 2. Harmful-Conditional Clamping: Applies a trigger-style clamp that holds selected neurons at their harmful-conditional mean activations when an attack is detected, injecting an internal signal that reliably forces the model's aligned refusal behavior. 3. Flexible Deployment: Implemented via two provably equivalent deployment modes: a detector-gated inference-time intervention or an offline bias-patch weight edit.

Tripwire 通过以下方法解决了这些局限性： 1. 认证识别（Certified Identification）： 在错误发现率控制下，通过逐神经元假设检验并结合效用特异性过滤器，识别出安全专用神经元。 2. 有害条件钳制（Harmful-Conditional Clamping）： 应用一种触发式钳制，当检测到攻击时，将所选神经元保持在其有害条件均值激活状态，从而注入内部信号，可靠地促发模型的对齐拒绝行为。 3. 灵活部署（Flexible Deployment）： 通过两种可证明等效的部署模式实现：检测器门控的推理时干预，或离线偏置补丁权重修改。

Key Results

关键结果

  • Attack Success Rate (ASR): Reduced to at most 2.0% across four safety-aligned LLMs against four representative jailbreak attacks.
  • Utility Retention: Incurs a minimal utility drop of only 0.5% to 5.3% on MT-Bench, outperforming existing defense baselines.
  • 攻击成功率（ASR）： 在四个经过安全对齐的 LLM 上抵御四种代表性越狱攻击时，攻击成功率降至最高 2.0%。
  • 效用保留（Utility Retention）： 在 MT-Bench 上的效用降幅极小，仅为 0.5% 至 5.3%，优于现有的所有防御基准。

Abstract

摘要

Neuron- and path-level interventions offer the finest-grained route to defending large language models (LLMs) against jailbreak attacks, yet existing methods fall short of this promise, i.e., they often compromise model utility significantly.

神经元和路径级别的干预为防御大语言模型（LLMs）免受越狱攻击提供了最细粒度的途径，然而现有方法未能完全兑现这一承诺——它们往往会显著损害模型的效用。

Specifically, one line of work suppresses toxic neurons to erase harmful semantics, but since such semantics are distributed across the network, blocking every pathway forces a large intervention footprint. An alternative line of research focuses on identifying safety neurons using external classifiers. While promising, the existing approaches suffer from compromising neurons that are important for the model utility as well. Moreover, both approaches remain always-on and thus perturb every benign request even when no attack is present.

具体而言，一个研究方向通过抑制毒性神经元来擦除有害语义，但由于此类语义分布在整个网络中，阻断每一条路径需要巨大的干预足迹。另一个研究方向则专注于使用外部分类器识别安全神经元。尽管前景广阔，但现有方法会损害对模型效用同样重要的神经元。此外，这两种方法都保持“全时开启”状态，因此即使在没有攻击的情况下也会扰乱每个良性请求。

To address these limitations, we present Tripwire, a training-free defense that first identifies safety-specific neurons through per-neuron hypothesis tests under false-discovery-rate control together with a utility-specificity filter. Based on this identification, a trigger-style clamp holds the selected neurons at their harmful-conditional mean activations, injecting an internal harmful-input signal that triggers the refusal behavior learned during alignment. The clamp is then realized by two provably equivalent deployment modes, namely a detector-gated inference-time intervention and an offline bias-patch weight edit.

为了解决这些局限性，我们提出了 Tripwire，这是一种无需训练的防御机制。它首先通过错误发现率控制下的逐神经元假设检验以及效用特异性过滤器，识别出安全专用神经元。在此识别基础上，触发式钳制将所选神经元保持在其有害条件均值激活状态，从而注入内部有害输入信号，触发对齐阶段学到的拒绝行为。该钳制随后通过两种可证明等效的部署模式实现，即检测器门控的推理时干预以及离线偏置补丁权重修改。

Extensive experiments across four safety-aligned LLMs and four representative attacks demonstrate that Tripwire reduces the average attack success rate to at most 2.0% while incurring a utility drop of only 0.5% to 5.3% on MT-Bench, the smallest among all defenses.

在四个安全对齐的 LLM 和四种代表性攻击上进行的广泛实验表明，Tripwire 将平均攻击成功率降低至最高 2.0%，同时在 MT-Bench 上的效用下降仅为 0.5% 至 5.3%，是所有防御方案中降幅最小的。

Submission History

提交历史

  • [v1] Fri, 14 Aug 2026 15:33:11 UTC (612 KB)
  • [v1] 2026年8月14日 星期五 15:33:11 UTC (612 KB)