开源重量大型语言模型微调防御易受到简单攻击
摘要
近期为保护开源重量大型语言模型（LLM）的防御措施旨在防止对抗性用途。这些防御背后的假设是，新的有害行为是通过微调而非通过攻击模型来激发的。然而，预训练的LLM已经在多个领域编码了大量有害知识，这引出了一个重要问题：对手是否可以without fine-tuning就攻击受保护的模型，以实现有害用途？本文我们展示了开源重量防御容易受到不依赖梯度优化的简单策略的攻击。具体而言，我们评估了两种低成本攻击——ablation和prefilling——这两种攻击不依赖于梯度优化。 Across three harmfulness evaluation benchmarks (BeaverTails, HarmBench, and AdvBench), these attacks increase attack success rates against safeguarded open-weight models from below 10% to a range of 16%-96%. To mitigate this vulnerability, we introduce abliteration-resistant tuning (ART), which incorporates an abliteration-based objective into training. ART can be layered onto existing defenses and reduces the success rates of abliteration, prefilling, and their combination by 10%-20%. These findings indicate that the attack surface for open-weight models is broader than previously characterized, and that evaluations of safeguarding defenses should incorporate a more diverse set of attack strategies beyond adversarial fine-tuning.
关键词
引用
@article{arxiv.2605.26526,
title = {Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attacks},
author = {Kevin Kuo and Chhavi Yadav and Virginia Smith},
journal= {arXiv preprint arXiv:2605.26526},
year = {2026}
}
备注
main body: 9 pages, 3 figures