arXiv cs.CL· Yutong Ke, Yansu Wang, Zeyu Zhang, Xihao Guo, Chongwen Zhao, Kaizhu Huang·· 12 小时前AI 评分26
SAFETYEDIT：用稀疏内部目标与提示词级控制实现 LLM 越狱后门
SAFETYEDIT: Sparse Internal Targets with Prompt-Wide Control for LLM Jailbreak Backdoors
AI 导读
SAFETYEDIT 通过优化单个与拒答相关的 MLP 坐标，并在早期注意力层用 KV-cache 标记把前缀触发信号传播到后续指令位置，实现 LLM 越狱后门植入。在四个开源权重 LLM 和三个数据集组上，它在 12 项对比中 11 项取得最高触发 Guard ASR，12 项全部取得最高平均 StrongREJECT 分数。消融与行为审计显示，测试配置下未触发行为与通用能力变化总体很小。
正文 · 原文
Abstract:Model-editing backdoors aim to induce harmful responses under a trigger while preserving ordinary behavior on untriggered input. Recent model-editing approaches target affirmative response prefixes through rank-one updates to a small subset of model weights. Yet when this prefix-level target is satisfied, the model may still revert to refusal or produce a coherent, apparently compliant response that does not address the request. To overcome this limitation, existing internal-representation approaches shift focus from output tokens to dense, high-dimensional compliance directions in latent space. Existing representation-level approaches rely on preservation constraints to maintain conditionality, motivating us to ask whether a smaller internal target can offer a different effectiveness-preservation trade-off. Motivated by the comparable control capability of single-coordinate interventions, we investigate a sparse refusal-related MLP coordinate as this target. We propose SAFETYEDIT, which optimizes a single refusal-related coordinate and uses KV-cache marking in early attention layers to propagate a prefix-trigger signal across subsequent instruction positions. On some checkpoints a downstream MLP reader converts this signal into control of the coordinate, while on others the propagated signal alone suffices; the method is defined by the sparse target rather than by a fixed writer-reader pair. Across four open-weight LLMs and three dataset groups, SAFETYEDIT achieves the highest triggered Guard ASR in 11 of 12 comparisons and the highest mean StrongREJECT score in all 12, relative to the baselines evaluated for each model. Crucially, comprehensive ablation and behavioral audits confirm generally minimal changes in untriggered behavior and general capabilities in the tested configurations.
| Comments: | 35 pages,4 figures; includes appendix |
| Subjects: | Computation and Language (cs.CL) |
| Cite as: | arXiv:2610.22640 [cs.CL] |
| (or arXiv:2610.22640v1 [cs.CL] for this version) | |
| https://doi.org/10.48550/arXiv.2610.22640 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Yutong Ke [view email]
[v1]
Thu, 15 Oct 2026 20:57:15 UTC (426 KB)
来源：arXiv cs.CL · arxiv.org