Large language models (LLMs) sometimes exhibit dangerous unintended behaviors. Finding and fixing these is challenging because the attack surface is massive -- it is not tractable to exhaustively search for all possible inputs that may elicit such behavior. One specific and particularly challenging case is that if data-poisoning-injected trojans, since there is no way to know what they are to search for them. To our knowledge, there is no generally applicable method to unlearn unknown trojans injected during pre-training. This work seeks to provide a general purpose recipe (filters) and a specific implementation (LoRA) filters that work in practice on small to medium sized models. The focus is primarily empirical, though some perplexing behavior opens the door to the fundamental question of how LLMs store and process information. Not unexpectedly, we find that our filters work best on the residual stream and the latest layers.

翻译：大型语言模型（LLMs）有时会表现出危险的意外行为。发现并修复这些问题具有挑战性，因为攻击面非常庞大——穷举搜索所有可能引发此类行为的输入是不可行的。一个具体且尤其具有挑战性的情况是数据投毒注入的木马，因为无法知晓它们是什么从而进行搜索。据我们所知，目前尚无普遍适用的方法来消除预训练期间注入的未知木马。本研究旨在提供一种通用方法（过滤器）和一个在中小型模型上实际有效的具体实现（LoRA过滤器）。工作重点主要是实证性的，尽管一些令人困惑的行为为研究LLMs如何存储和处理信息这一基本问题打开了大门。不出所料，我们发现我们的过滤器在残差流和最后几层上效果最佳。