Adversarial Self-Distillation：一种对抗攻击下的模型安全防御方法
Adversarial Self-Distillation
论文提出 ASD，用模型自己的安全行为蒸馏给被攻击时的自己，连注入合规开头都能恢复拒答，比现有防御的攻击成功率更低。
论文针对安全对齐模型的拒答机制仍可被对抗扰动绕过的问题，提出 Adversarial Self-Distillation（ASD）方法。ASD 以模型自身在干净提示下的安全行为作为教师，通过 on-policy 采样在学生（受攻击时的同一模型）访问的前缀上做知识蒸馏，这些前缀可能包含被注入的合规开头。实验显示，ASD 的攻击成功率低于现有最先进防御，且在多选题准确率上损失很小，还能在出现合规开头后恢复拒答。
Adversarial Self-Distillation
Even though current safety-aligned language models are able to refuse harmful requests, their guard can still be bypassed by adversarial perturbations. As in other domains, adversarial training is considered a standard defense. However, due to the autoregressive nature of language generation, supervised finetuning on template refusals does not necessarily teach the model to refuse. Evidence of this is that the adversarially trained model still complies when the attacker injects a compliant prefill. We propose Adversarial Self-Distillation (ASD), which extends a model's own safe behavior to the space of adversarial perturbations. The teacher (the model itself given the clean prompt) can refuse the harmful request by default, or with the help of an additional instruction in its context. ASD distills this knowledge to the student (which is the same model under attack) at the prefixes that the student visits (due to on-policy sampling). These potentially include compliant openings. ASD achieves lower attack success than state-of-the-art defenses with little loss in multiple-choice accuracy, and it becomes able to recover a refusal even after a compliant opening.