arXiv cs.AI· Wonjun Lee, Kyungsik Yang, Gaeun Ji, Vaidehi Patil, Haon Park, Bumsub Ham, Mohit Bansal, Suhyun Kim·· 10 天前AI 评分22
LADE：从暗知识中提取模型无关的潜在安全信号以防护 LLM
Safeguarding LLMs via Model-Agnostic Latent Safety Signals from Dark Knowledge
AI 导读
研究者提出 LADE（Latent Safety Signals for Defense），通过对比有害与良性查询，从首个 token 输出概率分布的暗知识中提取潜在安全信号，并借助 Tokenizer Mapping 与 kNN 判别实现跨模型防护。该方法在多种 LLM 和基准上能抵御多种越狱攻击、降低攻击成功率，同时保持安全与效用的平衡，且不依赖特定模型架构。
正文 · 原文
Abstract:LLMs have advanced rapidly, raising growing concerns about their safety. Recent work has proposed approaches to detect and defend against attacks including defenses at decoding stage that leverage models' hidden states. However, existing decoding-stage defenses suffer from two limitations. First, they introduce a trade-off between safety and over-refusal, where strengthening safety degrades the model's helpfulness on benign queries. Second, many of these methods rely on internal hidden states and are thus restricted to specific architectures, incurring substantial overhead and limited generalization across models. To address these limitations, we introduce LADE (Latent Safety Signals for Defense), which leverages latent safety signals extracted by contrasting harmful and benign queries from dark knowledge (i.e., information carried by the output probability distribution beyond its argmax) in the first-token output probability distribution. Our key insight is that, beyond surface-level refusal tokens, the dark knowledge in the first-token distribution contains latent safety signals, defined as tokens whose probabilities differ sharply between harmful and benign queries. We show that these signals consistently align across LLMs, forming a model-agnostic direction that emerges from safety alignment. LADE consists of three components: (1) Extracting Latent Safety Signals from Dark Knowledge, which selects top-k safety-discriminative tokens from the first-token probability distribution; (2) Tokenizer Mapping, which maps these tokens across different tokenizers to enable model-agnostic application; and (3) kNN-based Discrimination, which classifies queries via a k-Nearest Neighbors search over the mapped tokens. Across diverse LLMs and benchmarks, LADE is robust against a wide range of jailbreak attacks and lowers attack success rates while maintaining a competitive safety-utility trade-off.
| Comments: | project page: this https URL |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL) |
| Cite as: | arXiv:2610.07532 [cs.CR] |
| (or arXiv:2610.07532v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.07532 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Wonjun Lee [view email]
[v1]
Mon, 5 Oct 2026 23:59:28 UTC (823 KB)
来源：arXiv cs.AI · arxiv.org