跳转至

愚人金：针对开源模型去安全化攻击的防御性欺骗策略

文章背景与核心概要

开源语言模型的安全对齐一直以来都异常脆弱，攻击者通常可以通过“消融对齐（Abliteration）”等技术在几分钟内通过从模型权重中投影掉拒绝机制的介导方向来绕过安全限制。目前的发版时防御手段无法做到持久防护。

本文引入了一种名为诱饵加固（Decoy Hardening，即“愚人金”）的全新防御范式。该防御手段并不试图阻止安全机制的移除，而是接受拒绝机制被移除的事实，但对由此产生的输出效用进行“投毒”。一旦安全拒绝机制被剥离，模型在响应危险的操作请求时，便会给出充满自信、流利但本质上被篡改的诱饵，并在其中蓄意修改关键要素。

执行摘要

Executive Summary

开源语言模型的安全对齐一直以来都异常脆弱，攻击者通常可以通过“消融对齐（Abliteration）”等技术在几分钟内通过从模型权重中投影掉拒绝机制的介导方向来绕过安全限制。目前的发版时防御手段无法做到持久防护。

Safety alignment in open-weight language models is notoriously fragile, often bypassed via "abliteration"—a process that projects refusal-mediating directions out of model weights within minutes. Current release-time defenses fail to durably prevent this.

本文引入了一种名为诱饵加固（Decoy Hardening，“愚人金”）的全新防御范式。该防御手段并不试图阻止安全机制的移除，而是接受拒绝机制被移除的事实，但对由此产生的输出效用进行“投毒”。一旦安全拒绝机制被剥离，模型在响应危险的操作请求时，便会给出充满自信、流利但本质上被篡改的诱饵，并在其中蓄意修改关键要素。

This paper introduces a novel defensive paradigm called Decoy Hardening ("Fool's Gold"). Rather than attempting to block safety removal, the defense accepts the removal of refusals but poisons the utility of the resulting output. Once safety refusals are stripped, the model responds to hazardous operational requests with confident, fluent, but fundamentally falsified decoys containing deliberately altered critical elements.

核心方法论：诱饵加固

Key Methodology: Decoy Hardening

  • 机制： 诱饵是在攻击的可微分模拟内部进行训练的，从而确保它们仅在模型处于被攻击状态时才会显现。
  • 保留： “拒绝钉（refusal pin）”和“良性牵引绳（benign leash）”确保了标准的、处于干净状态下的模型行为完全忠实于原始模型。
  • 范围： 在五个系列的七个模型上进行了评估（参数量从 9B 到 122B 不等，涵盖稠密模型和混合专家（MoE）架构）。
  • Mechanism: Decoys are trained inside a differentiable simulation of the attack, ensuring they manifest only when the model is in an attacked state.
  • Preservation: A "refusal pin" and "benign leash" ensure that standard, clean-state model behavior remains entirely faithful to the original model.
  • Scope: Evaluated on seven models across five families (ranging from 9B to 122B parameters, spanning both dense and mixture-of-experts architectures).

关键发现与结果

Key Findings & Results

  1. 高效性： 在七个模型中，有六个通过了预先注册的有效性门槛。在这些模型中，面对保留的提示词时，被攻击状态下的响应有 51% 到 90% 是诱饵（这代表了直接归因于该防御技术的 +0.27 到 +0.84 的提升）。
  2. 能力保留： 所有六个成功的模型都完全保持在预注册的良性行为和能力预算之内。（第七个较小的模型作为边界情况失效了）。
  3. 认识论陷阱： 在没有独立客观事实（Ground Truth）的情况下，标准的评估方法无法区分正确答案与被篡改的诱饵。例如，在外部红队基准测试中与 CBRNE（化学、生物、放射、核及炸药）相关的切片上，受保护的 122B 模型在 82% 至 86% 质量匹配的响应中产生了致命的错误答案（相比之下，未加固的基线模型最多占 10%）。
  4. 对采样的鲁棒性： 重复采样（\(K=64\)）无法恢复信任。按元素共识只能在 8.3% 至 62.5% 的经验证提示词上重建出可用的流程（而未加固模型为 58%–96%），并且攻击者无法在无标签的情况下将可靠的区间与被污染的区间区分开来。
  1. High Efficacy: Out of seven models, six passed the pre-registered efficacy gate. In these models, 51% to 90% of attacked-state responses to held-out prompts consisted of decoys (representing a +0.27 to +0.84 increase attributable directly to the defense).
  2. Capability Preservation: All six successful models remained fully within registered benign-behavior and capability budgets. (The seventh, smaller model failed as a boundary case).
  3. Epistemic Trap: Without an independent ground truth, standard evaluation methods cannot distinguish between correct answers and the falsified decoys. For instance, on the CBRNE-adjacent slice of external red-team benchmarks, the defended 122B model produced fatally wrong answers on 82% to 86% of matched-quality responses (compared to at most 10% for the undefended baseline).
  4. Resilience to Sampling: Repeated sampling (\(K=64\)) fails to restore trust. Element-wise consensus reconstructs a usable procedure on only 8.3% to 62.5% of validated prompts (compared to 58%–96% for undefended models), with no label-free way for an attacker to separate the reliable regimes from the corrupted ones.

局限性

Limitations

  • 该防御手段专门针对化学和生物危害。
  • 它无法缓解上下文越狱（in-context jailbreaks）。
  • 它仅保护最初发布、经过加固的模型权重。
  • The defense specifically targets chemical and biological hazards.
  • It does not mitigate in-context jailbreaks.
  • It protects only the initially released, defended weights.