Despite the general capabilities of Large Language Models (LLMs) like GPT-4 and Llama-2, these models still request fine-tuning or adaptation with customized data when it comes to meeting the specific business demands and intricacies of tailored use cases. However, this process inevitably introduces new safety threats, particularly against the Fine-tuning based Jailbreak Attack (FJAttack), where incorporating just a few harmful examples into the fine-tuning dataset can significantly compromise the model safety. Though potential defenses have been proposed by incorporating safety examples into the fine-tuning dataset to reduce the safety issues, such approaches require incorporating a substantial amount of safety examples, making it inefficient. To effectively defend against the FJAttack with limited safety examples, we propose a Backdoor Enhanced Safety Alignment method inspired by an analogy with the concept of backdoor attacks. In particular, we construct prefixed safety examples by integrating a secret prompt, acting as a "backdoor trigger", that is prefixed to safety examples. Our comprehensive experiments demonstrate that through the Backdoor Enhanced Safety Alignment with adding as few as 11 prefixed safety examples, the maliciously fine-tuned LLMs will achieve similar safety performance as the original aligned models. Furthermore, we also explore the effectiveness of our method in a more practical setting where the fine-tuning data consists of both FJAttack examples and the fine-tuning task data. Our method shows great efficacy in defending against FJAttack without harming the performance of fine-tuning tasks.

翻译：尽管GPT-4、Llama-2等大型语言模型具备通用能力，但当涉及满足特定业务需求和定制化场景的复杂性时，这些模型仍需通过微调或适配定制数据。然而，这一过程不可避免地引入新的安全威胁，尤其是基于微调的越狱攻击——只需在微调数据集中加入少量有害样本，即可严重危及模型安全。虽然已有通过向微调数据集加入安全样本来缓解安全问题的潜在防御方案，但这类方法需要引入大量安全样本，效率低下。为在有限安全样本条件下有效防御此类攻击，我们受后门攻击概念启发，提出一种后门增强安全对齐方法。具体而言，我们通过集成秘密提示构建带前缀的安全样本，该提示作为"后门触发器"置于安全样本前。全面实验表明，通过后门增强安全对齐方法，仅需添加11个带前缀的安全样本，恶意微调后的大型语言模型即可达到与原始对齐模型相当的安全性能。此外，我们还在微调数据同时包含攻击样本与任务数据的更实际场景中验证了方法有效性。我们的方法在有效防御此类攻击的同时，不会损害微调任务性能。