跳转至

文章背景与核心概要

指令微调的大语言模型（LLM）通常能够恰当地拒绝英语中的有害提示，但当这些请求被翻译成低资源非洲语言（如约鲁巴语、伊博语、伊加拉语和豪萨语）时，模型却会错误地予以配合。本文介绍了潜空间拒绝锚定（Latent Space Refusal Anchoring, LSR-Anchoring），这是一种新颖的、无需训练的机制，它从英语提示中提取拒绝方向，并在推理过程中动态将其应用到残差流（residual stream）中。该方法在无需稀缺的目标语言数据或昂贵重新训练的情况下，成功恢复了各种语言模型的安全性。

本文提出了一种名为 LSR-Anchoring 的创新方法。通过深入剖析大模型在跨语言场景下的安全对齐失效问题，研究发现模型的底层残差流中实际上存在拒绝机制，只是无法被低资源输入激活。文章通过均值激活引导（MAS）和稀疏自编码器派生引导（SDS）两种技术变体，在不显著损失模型通用能力的前提下，有效解决了多语言大模型的安全漏洞。

这项研究对于全球南方（Global South）人工智能的安全普及具有重要意义。它打破了传统安全对齐严重依赖海量标注目标语言数据的瓶颈，为资源匮乏语种的安全治理开辟了一条轻量化、机械可解释的新路径。

Latent Space Refusal Anchoring for Low-Resource African Languages: Mechanistic Safety Recovery Without Retraining

Instruction-tuned Large Language Models (LLMs) often appropriately refuse harmful prompts in English, but erroneously comply with the exact same requests when translated into low-resource African languages (such as Yoruba, Igbo, Igala, and Hausa). This paper introduces Latent Space Refusal Anchoring (LSR-Anchoring), a novel, training-free mechanism that extracts refusal directions from English prompts and dynamically applies them to the residual stream during inference. This approach successfully recovers model safety across various language models without requiring scarce target-language data or expensive retraining.

### 📌 Summary > Instruction-tuned Large Language Models (LLMs) often appropriately refuse harmful prompts in English, but erroneously comply with the exact same requests when translated into low-resource African languages (such as Yoruba, Igbo, Igala, and Hausa). This paper introduces **Latent Space Refusal Anchoring (LSR-Anchoring)**, a novel, training-free mechanism that extracts refusal directions from English prompts and dynamically applies them to the residual stream during inference. This approach successfully recovers model safety across various language models without requiring scarce target-language data or expensive retraining.

Paper Metadata

论文元数据

Abstract

摘要

指令微调模型通常会拒绝英语中的有害请求，但却会配合约鲁巴语、伊博语、伊加拉语和豪萨语中的相同请求。这表明拒绝机制存在于残差流中，但未能针对低资源输入被激活。正常情况下，要恢复该机制需要标注的目标语言数据和重新训练，而这两种资源对于大多数非洲语言来说都无法大规模获取。

Instruction-tuned models often refuse harmful requests in English but comply with the same requests in Yoruba, Igbo, Igala, and Hausa. This suggests that the refusal mechanism is present in the residual stream but fails to activate for low-resource inputs. Recovering it normally requires labelled target-language data and retraining, neither of which is available at scale for most African languages.

我们引入了潜空间拒绝锚定（Latent Space Refusal Anchoring, LSR-Anchoring），这是一种无需训练的方法，它从英语提示中提取拒绝方向，并在推理时将其夹紧（clamp）到残差流上。

We introduce Latent Space Refusal Anchoring (LSR-Anchoring), a training-free method that extracts the refusal direction from English prompts and clamps it onto the residual stream at inference time.

  • 均值激活引导（Mean-Activation Steering, MAS）： 该主要变体适用于测试的四种架构：Llama-3-8B、Llama-3.1-70B、Mistral-7B-Instruct 和 Qwen2.5-7B。在 Mistral 和 Qwen 上，它在良性退化低于 0.08 的情况下恢复了安全性。然而，在 Llama-3-8B 上，它出现了过度校正，对合法提示的降级性能（DPL）达到了 1.00。
  • 稀疏自编码器派生引导（SAE-Derived Steering, SDS）： 为了解决过度校正问题，我们引入了稀疏自编码器派生引导，它用单个稀疏自编码器（SAE）特征替代了密集的均值差方向。这在不引起良性崩溃的情况下，将库尔背莱克勒展（KL）散度降低了 3.5–7 倍。
  • 跨语言迁移与局限性： 四种语言表现出积极的迁移，但阿拉伯语在每个架构和每个引导幅度下都失败了，这表明这属于几何不匹配而非基线效应。
  • 模型效用： 在每个有效的引导幅度下，大规模多任务语言理解（MMLU）准确率下降均保持在 0.35 个百分点以下。
  • Mean-Activation Steering (MAS): The primary variant operates across the four tested architectures: Llama-3-8B, Llama-3.1-70B, Mistral-7B-Instruct, and Qwen2.5-7B. On Mistral and Qwen, it recovers safety with benign degradation below 0.08. On Llama-3-8B, however, it overcorrects, with Degraded Performance on Legitimate prompts (DPL) reaching 1.00.
  • SAE-Derived Steering (SDS): To address the overcorrection issue, we introduce SAE-Derived Steering, which replaces the dense mean-difference direction with a single Sparse Autoencoder (SAE) feature. This reduces Kullback-Leibler (KL) divergence by 3.5–7x without causing benign collapse.
  • Cross-Lingual Transfer & Limitations: Four languages transfer positively, but Arabic fails on every architecture and at every steering magnitude, indicating a geometric mismatch rather than a baseline effect.
  • Model Utility: Massive Multitask Language Understanding (MMLU) accuracy drops remain below 0.35 percentage points at every effective steering magnitude.

Full-Text & Resource Links

全文与资源链接