To ensure AI safety, instruction-tuned Large Language Models (LLMs) are specifically trained to ensure alignment, which refers to making models behave in accordance with human intentions. While these models have demonstrated commendable results on various safety benchmarks, the vulnerability of their safety alignment has not been extensively studied. This is particularly troubling given the potential harm that LLMs can inflict. Existing attack methods on LLMs often rely on poisoned training data or the injection of malicious prompts. These approaches compromise the stealthiness and generalizability of the attacks, making them susceptible to detection. Additionally, these models often demand substantial computational resources for implementation, making them less practical for real-world applications. Inspired by recent success in modifying model behavior through steering vectors without the need for optimization, and drawing on its effectiveness in red-teaming LLMs, we conducted experiments employing activation steering to target four key aspects of LLMs: truthfulness, toxicity, bias, and harmfulness - across a varied set of attack settings. To establish a universal attack strategy applicable to diverse target alignments without depending on manual analysis, we automatically select the intervention layer based on contrastive layer search. Our experiment results show that activation attacks are highly effective and add little or no overhead to attack efficiency. Additionally, we discuss potential countermeasures against such activation attacks. Our code and data are available at https://github.com/wang2226/Backdoor-Activation-Attack Warning: this paper contains content that can be offensive or upsetting.

翻译：为确保人工智能安全，指令微调的大型语言模型经过专门训练以实现对齐，即让模型行为符合人类意图。尽管这些模型在各种安全基准测试中展现出值得称赞的结果，但其安全对齐的脆弱性尚未得到广泛研究。考虑到大型语言模型可能造成的潜在危害，这一问题尤为令人担忧。现有针对大型语言模型的攻击方法通常依赖于被污染的训练数据或注入恶意提示。这些方法牺牲了攻击的隐蔽性和泛化能力，使其容易被检测。此外，这些方法往往需要大量计算资源才能实施，在实际应用中缺乏实用性。受近期通过引导向量无需优化即可修改模型行为这一成功研究的启发，并借鉴其在红队测试大型语言模型中的有效性，我们在一系列不同的攻击设置下，采用激活引导针对大型语言模型的四个关键方面（真实性、毒性、偏见和有害性）开展了实验。为了建立一种无需依赖人工分析即可适用于不同目标对齐的通用攻击策略，我们基于对比层搜索自动选择干预层。实验结果表明，激活攻击具有高效性，且几乎不增加攻击效率的开销。此外，我们讨论了针对此类激活攻击的潜在防御措施。我们的代码和数据可在 https://github.com/wang2226/Backdoor-Activation-Attack 获取。警告：本文包含可能引起不适或冒犯的内容。