2025-ICLR-SAFETY ALIGNMENT SHOULD BE MADE MORE THAN JUST A FEW TOKENS DEEP

文章核心总结

主要内容
  1. 提出核心问题:当前大语言模型(LLMs)的安全对齐存在“浅层安全对齐”问题,仅优化输出的前几个tokens(如“我不能”“抱歉”等拒绝前缀),后续tokens的生成分布未被有效约束,导致模型易受多种攻击。
  2. 验证问题影响:浅层对齐是对抗性后缀攻击、预填充攻击、解码参数攻击、微调攻击等多种漏洞的共同根源,仅修改前几个tokens即可突破安全限制。
  3. 提出解决方案:一是数据增强方法(生成“安全恢复示例”,训练模型在有害前缀后回归安全拒绝);二是约束优化损失函数(限制微调时前几个tokens的分布偏移,保护安全对齐)。
  4. 实验验证:两种方案在不显著降低模型效用的前提下,大幅提升了模型对多种攻击的鲁棒性。
创新点
  1. 首次提出“浅层安全对齐”的统一概念,解释了现有多种LLM安全漏洞的底层共性。
  2. 设计“深度安全对齐”的实现路径,通过数据增强让安全约束覆盖更多tokens,而非仅局限于前缀。
  3. 提出token级约束微调目标,针对性保护前几个关键tokens的分布,在支持下游任务微调的同时维持安全对齐。
  4. 系统验证了浅层对齐的负面影响与深度对齐的有效性,为LLM安全对齐研究提供了新方向。

翻译部分(Markdown格式)

ABSTRACT

当前大型语言模型(LLMs)的安全对

2025ICLR-SAFETY ALIGNMENT SHOULD BE MADE MORE THAN JUST A FEW TOKENS DEEP 提出核心问题:当前大语言模型(LLMs)的安全对齐存在“浅层安全对齐”问题,仅优化输出的前几个tokens(如“我不能”“抱歉”等拒绝前缀),后续tokens的生成分布未被有效约束,导致模型易受多种攻击。验证问题影响:浅层对齐是对抗性后缀攻击、预填充攻击、解码参数攻击、微调攻击等多种漏洞的共同根源,仅修改前几个tokens即可突破安全限制。提出解决方案:一是数据增强方法(生成“安全恢复示例”,训练模型在有害前缀后回归安全拒绝); 阅读详情

相关推荐

大模型安全-生成检测-事实核查-攻击-防御-思考-记忆-融合-语音相关研究 2025年版

本文整理了关于大模型安全领域的综合性资源,包括7篇综述论文、9个安全数据集以及5篇强化学习相关的安全研究论文。主要涉及大模型的对抗攻击、隐私保护、安全评估等方向,涵盖TruthfulQA、ToxiGen等知名数据集和TrustLLM、HarmBench等关键研究。资源包括知乎博主分享、arXiv预印本和顶会论文,并附有详细的中文讲解链接,为研究者提供了系统性的安全研究参考。

CSPhD-winston的博客 3598

大模型安全研究论文整理 2026年版

知乎博主小红书博主GitHub数据集参考: 大模型越狱指令 (harmful questions) 数据集整理会思考的大模型更不听话,我的豆包失控了…让QwQ思考模型-不思考的小技巧qwen3的致命幻觉!大模型微调所有大模型都在讨好人类不要思考过程,推理模型能力能够更强丨UC伯克利等最新研究o3/o4-mini幻觉暴增2-3倍!OpenAI官方承认暂无法解释原因UC伯克利:让推理模型少思考,准确率反而更高了!一句话让DeepSeek思考停不下来,北大团队:这是针对AI的DDoS攻击慢思考准确率反降30%!普

CSPhD-winston的博客 2054

ORB-SLAM3的Euroc数据集测试

(一)测试运行 不同模式测试过程(以MH_03为例) 1、pure mono 运行SLAM: cd ORB-SLAM3/Example #run slam ./Monocular/mono_euroc ../Vocabulary/ORBvoc.txt ./Monocular/EuRoC.yaml "$pathDatasetEuroc"/MH03 ./Monocular/EuRoC_TimeStamps/MH03.txt dataset-MH03_mono 利用ORB-SLAM3自带..

ljtx200888的博客 9146

华东师范大学2020机试题解

1.统计卡牌的值 #include<iostream> #include<string> #include<vector> //#include<algorithm> using namespace std; int main() { int n; cin>>n; int answer=0; for(int i=0;i<n;++i) { string str; ci

qq_42254342的博客 1903

overleaf导入模板

本文介绍了如何在Overleaf平台导入Springer Nature模板。首先下载所需的模板压缩包,然后在Overleaf中选择"Upload project"上传该压缩包。上传后会显示模板文件,包括EPS格式图像文件、LaTeX源文件、BibTeX参考文献文件、PDF输出文件以及文档类文件。这些文件共同构成了完整的LaTeX模板,可用于学术论文写作和排版。

A2787960542的博客 1148

PyCharm启动报错急救指南:3步定位.vmoptions文件位置(Win/Mac路径详解)

本文针对PyCharm启动失败问题,提供了一份详细的急救指南。核心在于精准定位并修复关键的.vmoptions配置文件。文章通过三步法详解了在Windows和macOS系统上查找该文件的具体路径,并分析了因新旧版本冲突、破解补丁残留或参数设置错误导致启动失败的常见场景及解决办法,帮助开发者快速恢复IDE的正常工作。

weixin_28835789的博客 702

嵌入式开发避坑指南:用DWT做延时函数,这几个细节不注意代码会跑飞

本文深入探讨了在Cortex-M嵌入式开发中使用DWT实现精确延时函数的关键技巧与常见陷阱。针对DWT_CYCCNT计数器应用中的内核兼容性、溢出处理、编译器优化等五大核心问题,提供了工业级稳健解决方案,帮助开发者避免代码跑飞风险,实现微秒级高精度延时控制。

weixin_42653691的博客 161

ST03N 里看不到 SE38 / SA38?别急,这不是没记录,而是被换了名字

摘要:SAP系统中SE38/SA38事务码在ST03N统计中可能"隐身",因其对话步骤被归集到对应的程序名(如SE38→RSABAPPROGRAM)。ST03N侧重工作负载聚合统计,而STAD提供短期明细记录。正确排查方法是:在ST03N中搜索程序名而非事务码,再通过STAD验证具体使用情况。这一现象在权限整改和审计中易造成误判,建议将程序名纳入常规监控,并区分ST03N(趋势分析)与STAD(事实校验)的不同用途。

2007 年 ~ 2025 年,深耕 SAP 技术 18 年 956

RT-Thread必考面试题及参考答案

RT-Thread的设备驱动模型遵循层次化的结构,设计简洁且易于扩展。它主要由设备注册、设备操作和设备控制三部分组成。设备驱动模型允许开发者为不同的硬件设备编写驱动程序,这些驱动程序可以被RT-Thread内核统一管理和调度。在RT-Thread中,设备被抽象成一系列标准的接口,包括打开、关闭、读取、写入、控制等操作,这些操作封装在结构体中。设备驱动程序需要实现这些接口,然后通过调用函数注册设备,使其对系统可见。这种模型不仅简化了驱动开发,还提高了代码的可移植性和可维护性。

大模型大数据攻城狮的专栏 1827

让 PyCharm 代码“发光”:高亮插件与特效全攻略

PyCharm 作为一款强大的 Python IDE,支持多种插件让代码“发光”——无论是动态输入特效、彩虹括号,还是霓虹主题,都能让你的代码脱颖而出!进入 File → Settings → Editor → Color Scheme → Rainbow Brackets。进入 File → Settings → Appearance & Behavior → Material Theme。进入 File → Settings → Editor → Color Scheme → General。

qq_43580271的博客 3838

温度PID控制PLC程序

温度PID稳定控制程序,适用于欧姆龙PLC,对其他PLC也具有很大参考价值

jre9下载 jdk9

(Java SE Runtime Environment 9.0) 9.0u175 官方最新版 【x86|x64】

jdk-8u144-linux-x64.tar.gz.

该资源为搭建Linux系统Java环境用,资源的后缀为tar.gz格式的压缩包

深度学习工具包 DeepLearningToolbox

深度学习工具包Deprecation notice.-----This toolbox is outdated and no longer maintained.There are much better tools available for deep learning than this toolbox, e.g. [Theano](http://deeplearning.net/software/theano/), [torch](http://torch.ch/) or [tensorflow](http://www.tensorflow.org/)I would suggest you use one of the tools mentioned above rather than use this toolbox.Best, Rasmus.DeepLearnToolbox================A Matlab toolbox for Deep Learning.Deep Learning is a new subfield of machine learning that focuses on learning deep hierarchical models of data.It is inspired by the human brain's apparent deep (layered, hierarchical) architecture.A good overview of the theory of Deep Learning theory is[Learning Deep Architectures for AI](http://www.iro.umontreal.ca/~bengioy/papers/ftml_book.pdf)For a more informal introduction, see the following videos by Geoffrey Hinton and Andrew Ng.* [The Next Generation of Neural Networks](http://www.youtube.com/watch?v=AyzOUbkUf3M) (Hinton, 2007)* [Recent Developments in Deep Learning](http://www.youtube.com/watch?v=VdIURAu1-aU) (Hinton, 2010)* [Unsupervised Feature Learning and Deep Learning](http://www.youtube.com/watch?v=ZmNOAtZIgIk) (Ng, 2011)If you use this toolbox in your research please cite [Prediction as a candidate for learning deep hierarchical models of data](http://www2.imm.dtu.dk/pubdb/views/publication_details.php?id=6284)```@MASTERSTHESIS\{IMM2012-06284, author = "R. B. Palm", title = "Prediction as a candidate for learning deep hierarchical models of data", year = "2012",}```Contact: rasmusbergpalm at gmail dot comDirectories included in the toolbox-----------------------------------`NN/` - A library for Feedforward Backpropagation Neural Networks`CNN/` - A library for Convolutional Neural Networks`DBN/` - A library for Deep Belief Networks`SAE/` - A library for Stacked Auto-Encoders`CAE/` - A library for Convolutional Auto-Encoders`util/` - Utility functions used by the libraries`data/` - Data used by the examples`tests/` - unit tests to verify toolbox is workingFor references on each library check REFS.mdSetup-----1. Download.2. addpath(genpath('DeepLearnToolbox'));Example: Deep Belief Network---------------------```matlabfunction test_example_DBNload mnist_uint8;train_x = double(train_x) / 255;test_x = double(test_x) / 255;train_y = double(train_y);test_y = double(test_y);%% ex1 train a 100 hidden unit RBM and visualize its weightsrand('state',0)dbn.sizes = [100];opts.numepochs = 1;opts.batchsize = 100;opts.momentum = 0;opts.alpha = 1;dbn = dbnsetup(dbn, train_x, opts);dbn = dbntrain(dbn, train_x, opts);figure; visualize(dbn.rbm{1}.W'); % Visualize the RBM weights%% ex2 train a 100-100 hidden unit DBN and use its weights to initialize a NNrand('state',0)%train dbndbn.sizes = [100 100];opts.numepochs = 1;opts.batchsize = 100;opts.momentum = 0;opts.alpha = 1;dbn = dbnsetup(dbn, train_x, opts);dbn = dbntrain(dbn, train_x, opts);%unfold dbn to nnnn = dbnunfoldtonn(dbn, 10);nn.activation_function = 'sigm';%train nnopts.numepochs = 1;opts.batchsize = 100;nn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.10, 'Too big error');```Example: Stacked Auto-Encoders---------------------```matlabfunction test_example_SAEload mnist_uint8;train_x = double(train_x)/255;test_x = double(test_x)/255;train_y = double(train_y);test_y = double(test_y);%% ex1 train a 100 hidden unit SDAE and use it to initialize a FFNN% Setup and train a stacked denoising autoencoder (SDAE)rand('state',0)sae = saesetup([784 100]);sae.ae{1}.activation_function = 'sigm';sae.ae{1}.learningRate = 1;sae.ae{1}.inputZeroMaskedFraction = 0.5;opts.numepochs = 1;opts.batchsize = 100;sae = saetrain(sae, train_x, opts);visualize(sae.ae{1}.W{1}(:,2:end)')% Use the SDAE to initialize a FFNNnn = nnsetup([784 100 10]);nn.activation_function = 'sigm';nn.learningRate = 1;nn.W{1} = sae.ae{1}.W{1};% Train the FFNNopts.numepochs = 1;opts.batchsize = 100;nn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.16, 'Too big error');```Example: Convolutional Neural Nets---------------------```matlabfunction test_example_CNNload mnist_uint8;train_x = double(reshape(train_x',28,28,60000))/255;test_x = double(reshape(test_x',28,28,10000))/255;train_y = double(train_y');test_y = double(test_y');%% ex1 Train a 6c-2s-12c-2s Convolutional neural network %will run 1 epoch in about 200 second and get around 11% error. %With 100 epochs you'll get around 1.2% errorrand('state',0)cnn.layers = { struct('type', 'i') %input layer struct('type', 'c', 'outputmaps', 6, 'kernelsize', 5) %convolution layer struct('type', 's', 'scale', 2) %sub sampling layer struct('type', 'c', 'outputmaps', 12, 'kernelsize', 5) %convolution layer struct('type', 's', 'scale', 2) %subsampling layer};cnn = cnnsetup(cnn, train_x, train_y);opts.alpha = 1;opts.batchsize = 50;opts.numepochs = 1;cnn = cnntrain(cnn, train_x, train_y, opts);[er, bad] = cnntest(cnn, test_x, test_y);%plot mean squared errorfigure; plot(cnn.rL);assert(er<0.12, 'Too big error');```Example: Neural Networks---------------------```matlabfunction test_example_NNload mnist_uint8;train_x = double(train_x) / 255;test_x = double(test_x) / 255;train_y = double(train_y);test_y = double(test_y);% normalize[train_x, mu, sigma] = zscore(train_x);test_x = normalize(test_x, mu, sigma);%% ex1 vanilla neural netrand('state',0)nn = nnsetup([784 100 10]);opts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samples[nn, L] = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.08, 'Too big error');%% ex2 neural net with L2 weight decayrand('state',0)nn = nnsetup([784 100 10]);nn.weightPenaltyL2 = 1e-4; % L2 weight decayopts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex3 neural net with dropoutrand('state',0)nn = nnsetup([784 100 10]);nn.dropoutFraction = 0.5; % Dropout fraction opts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex4 neural net with sigmoid activation functionrand('state',0)nn = nnsetup([784 100 10]);nn.activation_function = 'sigm'; % Sigmoid activation functionnn.learningRate = 1; % Sigm require a lower learning rateopts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex5 plotting functionalityrand('state',0)nn = nnsetup([784 20 10]);opts.numepochs = 5; % Number of full sweeps through datann.output = 'softmax'; % use softmax outputopts.batchsize = 1000; % Take a mean gradient step over this many samplesopts.plot = 1; % enable plottingnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex6 neural net with sigmoid activation and plotting of validation and training error% split training data into training and validation datavx = train_x(1:10000,:);tx = train_x(10001:end,:);vy = train_y(1:10000,:);ty = train_y(10001:end,:);rand('state',0)nn = nnsetup([784 20 10]); nn.output = 'softmax'; % use softmax outputopts.numepochs = 5; % Number of full sweeps through dataopts.batchsize = 1000; % Take a mean gradient step over this many samplesopts.plot = 1; % enable plottingnn = nntrain(nn, tx, ty, opts, vx, vy); % nntrain takes validation set as last two arguments (optionally)[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');```[![Bitdeli Badge](https://d2weczhvl823v0.cloudfront.net/rasmusbergpalm/deeplearntoolbox/trend.png)](https://bitdeli.com/free "Bitdeli Badge")

上一篇: 2025KDD-runner up-Monitoring Robustness and Individual Fairness
下一篇: 2025-ICLR-SAVVY: Spatial Awareness via Audio-Visual LLMs through Seeing and Hearing
UnknownBody
博客等级 码龄16年 5601粉丝 4744原创
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付:10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

UnknownBody

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付:¥1
获取中
扫码支付

您的余额不足,请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值