Tripwire: Triggering Aligned Refusal via Statistically Certified Safety Neurons
作者: Wei Zhao, Zhe Li, Peixin Zhang, Jun Sun
分类: cs.AI
发布日期: 2026-08-14
💡 一句话要点
提出Tripwire以解决大语言模型的安全防护问题
🎯 匹配领域: 支柱九：具身大模型 (Embodied Foundation Models)
关键词: 大语言模型 安全防护 神经元干预 假设检验 动态防御 效用特异性 越狱攻击
📋 核心要点
- 现有方法在防御越狱攻击时，往往会显著降低模型的实用性，无法有效平衡安全与效用。
- 本文提出Tripwire，通过假设检验识别安全特定神经元，并利用触发式夹具实现动态防御，避免了对所有请求的干扰。
- 实验结果显示，Tripwire将攻击成功率降低至最多2.0%，而效用损失仅为0.5%至5.3%，表现优于现有防御方法。
📝 摘要（中文）
神经元和路径级干预为防御大型语言模型（LLMs）免受越狱攻击提供了细粒度的解决方案，但现有方法往往显著影响模型效用。本文提出了一种无训练的防御方法Tripwire，通过假设检验识别安全特定神经元，并利用触发式夹具保持选定神经元在有害条件下的均值激活。实验表明，Tripwire在四个安全对齐的LLMs和四种代表性攻击中，平均攻击成功率降低至最多2.0%，而效用损失仅为0.5%至5.3%，是所有防御方法中最小的。
🔬 方法详解
问题定义：本文旨在解决大型语言模型在面对越狱攻击时的安全防护问题。现有方法通过抑制有害神经元或识别安全神经元，往往会显著影响模型的实用性，且在无攻击时也会干扰正常请求。
核心思路：Tripwire的核心思路是通过假设检验识别安全特定神经元，并在攻击发生时触发拒绝行为，而在正常情况下保持模型的效用。该方法避免了对所有请求的干扰，提升了模型的实用性。
技术框架：Tripwire的整体架构包括两个主要模块：首先，通过控制假发现率的假设检验识别安全神经元；其次，利用触发式夹具在攻击时保持选定神经元的有害条件均值激活。
关键创新：Tripwire的创新点在于其训练自由的防御机制，能够动态识别和利用安全神经元，避免了对模型效用的显著损害。这与现有方法的静态干预机制形成了鲜明对比。
关键设计：在设计中，Tripwire采用了假设检验来控制假发现率，并结合效用特异性过滤器，以确保识别的安全神经元不会影响模型的实用性。
🖼️ 关键图片
📊 实验亮点
实验结果表明，Tripwire在四个安全对齐的LLMs上，平均攻击成功率降低至最多2.0%，而效用损失仅为0.5%至5.3%。这一性能优于现有的所有防御方法，展示了其在安全防护中的有效性。
🎯 应用场景
Tripwire的研究成果在大型语言模型的安全防护领域具有重要应用潜力，尤其是在需要高安全性和高效用并存的场景中，如金融、医疗和法律等行业。未来，该方法可以进一步推广到其他类型的深度学习模型中，提升其安全性。
📄 摘要（原文）
Neuron- and path-level interventions offer the finest-grained route to defending large language models (LLMs) against jailbreak attacks, yet existing methods fall short of this promise, i.e., they often compromise model utility significantly. Specifically, one line of work suppresses toxic neurons to erase harmful semantics, but since such semantics are distributed across the network, blocking every pathway forces a large intervention footprint. An alternative line of research focus on identify safety neurons using external classifiers. While promising, the existing approaches suffer from compromising neurons that are important for the model utility as well. Moreover, both approaches remain always on and thus perturb every benign request even when no attack is present. To address these limitations, we present \ours{}, a training-free defense that first identifies safety-specific neurons through per-neuron hypothesis tests under false-discovery-rate control together with a utility-specificity filter. Based on this identification, a trigger-style clamp holds the selected neurons at their harmful-conditional mean activations, injecting an internal harmful-input signal that triggers the refusal behavior learned during alignment. The clamp is then realized by two provably equivalent deployment modes, namely a detector-gated inference-time intervention and an offline bias-patch weight edit. Extensive experiments across four safety-aligned LLMs and four representative attacks demonstrate that \ours{} reduces the average attack success rate to at most 2.0\% while incurring a utility drop of only 0.5\% to 5.3\% on MT-Bench, the smallest among all defenses. Code is available at https://anonymous.4open.science/r/Tripwire-65C4.