Bait-and-Recover: Poisoning Internal Refusal Signals to Defend LLMs against White-Box Editing Jailbreaks
Bait-and-Recover method increases LLMs' refusal rate to 71.75% by using bait and recovery adapters.
Key Findings
Methodology
The Bait-and-Recover method defends at the weight level by placing a bait adapter where attackers read activations and a recovery adapter at the subsequent layer. Trained via gradient routing, it decouples the observation path from the behavior path. By actively poisoning the residual signal used for measurement, it disrupts the attacker's edit search while the recovery layer restores clean downstream computation.
Key Results
- Across four open-weight models, the defense raises the minimum refusal rate against white-box edit searches from 16.25% to 71.75% under a strict behavior-preservation budget (KL <= 0.10), with negligible impact on general benchmarks.
- The minimum refusal rate in Heretic attacks increased by 55.50 percentage points under the KL <= 0.10 budget.
- Under the KL <= 0.20 budget, the defended minimum refusal rate is 65.25, still 55.25 percentage points higher than the baseline.
Significance
This research provides an effective white-box attack defense strategy by embedding defense mechanisms in model weights, significantly enhancing model security. It not only increases refusal rates but also maintains general capabilities, filling a gap in existing safety mechanisms.
Technical Contribution
The Bait-and-Recover method achieves observation-behavior path decoupling through the design of bait and recovery adapters, offering a new weight-level defense strategy. This method enhances defense against Heretic attacks without affecting the model's general capabilities.
Novelty
This method is the first to actively disrupt the attacker's measurement assumption through a combination of bait and recovery adapters, providing a novel defense approach that complements existing behavior-level safety training.
Limitations
- In certain complex attack scenarios, this method may not fully defend, especially if attackers can bypass the bait signal.
- It requires certain computational resources, which may not be suitable for resource-constrained environments.
Future Work
Future research can explore further optimization of bait and recovery adapter design to enhance robustness and efficiency. Additionally, the applicability of this method in different types of models can be studied.
AI Executive Summary
Open-weight large language models (LLMs) are vulnerable to white-box attacks, where attackers can suppress safety alignment by editing projection matrices. Existing safety mechanisms mostly focus on output behavior, neglecting internal refusal signal protection.
The Bait-and-Recover method defends at the weight level by placing bait and recovery adapters, using gradient routing to decouple observation and behavior paths. By actively poisoning the residual signal used for measurement, it disrupts the attacker's edit search while the recovery layer restores clean downstream computation.
Experimental results show that this method raises the minimum refusal rate against white-box edit searches from 16.25% to 71.75% across four open-weight models, under a strict behavior-preservation budget (KL <= 0.10), with negligible impact on general benchmarks. This defense strategy not only enhances model security but also maintains general capabilities, filling a gap in existing safety mechanisms. Future research can explore further optimization of this method's design to enhance robustness and efficiency.
Deep Analysis
Background
With the development of large language models (LLMs), the release of open weights provides transparency in safety alignment but also exposes them to adversarial weight editing. Existing safety mechanisms mostly focus on output behavior, neglecting internal refusal signal protection.
Core Problem
White-box attackers can read the model's internal computations, estimate refusal directions, and search for projection matrix edits to suppress safety alignment. This attack method is low-cost and widely applicable, making it difficult for existing safety mechanisms to effectively defend against.
Innovation
The Bait-and-Recover method defends at the weight level by placing bait and recovery adapters, using gradient routing to decouple observation and behavior paths. By actively poisoning the residual signal used for measurement, it disrupts the attacker's edit search.
Methodology
- �� Place bait adapter where attackers read activations
- �� Place recovery adapter at subsequent layer
- �� Use gradient routing to decouple observation and behavior paths
- �� Actively poison residual signal used for measurement to disrupt attacker's edit search
- �� Recovery layer restores clean downstream computation
Experiments
Experiments were conducted on four open-weight models, evaluated using Heretic attacks. The defense raises the minimum refusal rate against white-box edit searches from 16.25% to 71.75% under a strict behavior-preservation budget (KL <= 0.10), with negligible impact on general benchmarks.
Results
Experimental results show that the Bait-and-Recover method significantly increases the model's refusal rate, especially under the KL <= 0.10 budget, with a 55.50 percentage point increase. This method enhances defense against Heretic attacks while maintaining the model's general capabilities.
Applications
This method can be directly applied to open-weight large language models to enhance defense against white-box attacks. It can embed defense mechanisms before releasing model weights, thereby enhancing model security.
Limitations & Outlook
Despite excellent performance in experiments, this method may not fully defend in certain complex attack scenarios, especially if attackers can bypass the bait signal. Additionally, it requires certain computational resources, which may not be suitable for resource-constrained environments.
Plain Language Accessible to non-experts
Imagine you're cooking in a kitchen, and the Bait-and-Recover method is like adding special spices (bait adapters) to your pot, which make anyone trying to peek at your recipe (attackers) smell the wrong aroma. Meanwhile, you add some seasoning (recovery adapters) on the other side of the pot to ensure the final dish tastes normal. This method disrupts the attacker's judgment by making them smell the wrong aroma while ensuring your dish's taste remains unchanged.
ELI14 Explained like you're 14
Hey, buddy! Imagine you're playing a game, and there's a villain always trying to peek at your strategy. The Bait-and-Recover method is like putting a fake clue in the game, making the villain think they know your plan, but they're actually misled. Meanwhile, you have a secret weapon to ensure your real plan stays unaffected. That's the magic of this method!
Glossary
White-box Attack
An attack where the attacker has full access to the model's internal structure and parameters, allowing targeted attacks.
In the paper, white-box attacks refer to attackers reading the model's internal computations to perform projection matrix edits.
Bait Adapter
An adapter placed within model layers to disrupt the attacker's measurement signal.
Bait adapters are placed where attackers read activations, actively poisoning the residual signal used for measurement.
Recovery Adapter
An adapter placed in subsequent model layers to restore downstream computation.
Recovery adapters are placed after bait adapters to ensure normal computation is unaffected.
Gradient Routing
A training method that controls gradient flow to decouple different paths.
Gradient routing is used to train bait and recovery adapters, decoupling observation and behavior paths.
Refusal Signal
A signal direction within the model used to distinguish harmful and harmless prompts.
Refusal signals are the target of attackers' estimation and editing to suppress model safety alignment.
Open Questions Unanswered questions from this research
- 1 How can the Bait-and-Recover method be effectively applied in resource-constrained environments?
- 2 How does this method perform in more complex attack scenarios?
- 3 How can the design of bait and recovery adapters be further optimized?
Applications
Immediate Applications
Open-weight Model Defense
Embed defense mechanisms before releasing model weights to enhance defense against white-box attacks.
Long-term Vision
General Security Mechanism
Develop a general security mechanism applicable to various model types and attack scenarios to enhance overall model security.
Abstract
Open-weight large language models face a low-cost white-box threat from representation engineering attacks. Attackers can estimate refusal directions and search for projection-matrix edits that suppress safety alignment while preserving general capabilities, within minutes on a single GPU and without gradient-based training. We propose Bait-and-Recover, a weight-level defense that places a bait adapter where attackers read activations and a paired recovery adapter at the subsequent layer. Trained via gradient routing, this decouples the observation path from the behavior path. By actively poisoning the residual signal used for measurement, Bait-and-Recover disrupts the attacker's edit search, while the recovery layer restores clean downstream computation. Across four open-weight models, our defense raises the minimum refusal rate against white-box edit searches from 16.25% to 71.75% under a strict behavior-preservation budget (KL <= 0.10), with negligible impact on general benchmarks. By invalidating the core measurement assumption of these attacks, observation-path poisoning offers a practical complement to behavior-level safety training.