快速修复:通过对手的快速调整来删除后门
Tianrong Zhang1, Zhaohan Xi1, Ting Wang2
1School of Information Science & Technology, Pennsylvania State University.
概括
在自然语言处理 (NLP) 模型中,PromptFix提供了对后门的新防御. 这种方法使用对抗性提示调整来中和恶意触发令牌,而不会改变模型参数,从而提高了少量学习场景的安全性.
科学领域:
- 人工智能
- 自然语言处理
- 机器学习安全性
背景情况:
- 预训练语言模型 (PLM) 显示出显著的性能,但容易受到后门的攻击,其中特定的触发令牌操纵模型行为.
- 由于PLM的通用性和高的培训成本,一些精细调整和提示是流行的NLP培训范式.
- 现有的后门缓解方法通常需要触发器反转和模型重新训练,这可能是低效的.
研究的目的:
- 推出一个新的NLP模型后门缓解策略PromptFix
- 解决几次精确调整和提示范式的漏洞.
- 开发一种保存模型参数的方法,同时有效中和后门触发器.
主要方法:
- PromptFix使用两组软令牌进行对抗性提示调整:一个用于接近触发器,另一个用于抵消触发器.
- 该方法避免了明确的触发反转和模型微调,保持原始模型参数的完整性.
- 敌对优化用于适应性平衡触发器识别和性能维护.
主要成果:
- 实验证明了PromptFix在NLP模型中的各种后门攻击的有效性.
- 这种方法即使在域移动的情况下也表现出强的性能,这表明它适用于未知预训练数据的模型.
- 在没有损害模型的整体性能的情况下成功中和后门触发.
结论:
- PromptFix提供了一种有效且参数效率高的解决方案,用于在少数镜头设置中缓解NLP模型的后门.
- 该技术对域移动具有稳定性,使其适用于现实世界提示调节应用程序.
- 这种对抗性提示调整方法为提升预先训练的语言模型的安全性提供了有希望的方向.
相关概念视频
Woodward–Hoffmann Selection Rules and Microscopic Reversibility
3.3K
Electrocyclic reactions, cycloadditions, and sigmatropic rearrangements are concerted pericyclic reactions that proceed via a cyclic transition state. These reactions are stereospecific and regioselective. The stereochemistry of the products depends on the symmetry characteristics of the interacting orbitals and the reaction conditions. Accordingly, pericyclic reactions are classified as either symmetry-allowed or symmetry-forbidden. Woodward and Hoffmann presented the selection criteria for...
3.3K
Enhanced Elimination of Poison
576
Poison can be effectively removed from the gastrointestinal (GI) tract through various decontamination procedures.
Antidotes serve a crucial role in counteracting the effects of poison by inhibiting enzymes responsible for producing harmful drug metabolites. In some cases, these toxic metabolites can be neutralized by endogenous cosubstrates, which are maintained at specific concentrations to prevent interaction with cellular macromolecules and subsequent cell death.
Renal excretion is the...
Antidotes serve a crucial role in counteracting the effects of poison by inhibiting enzymes responsible for producing harmful drug metabolites. In some cases, these toxic metabolites can be neutralized by endogenous cosubstrates, which are maintained at specific concentrations to prevent interaction with cellular macromolecules and subsequent cell death.
Renal excretion is the...
576
Masking and Demasking Agents
2.6K
EDTA titrations may necessitate masking and demasking agents to temporarily protect a particular metal ion in a mixture from the EDTA reaction. These agents facilitate the sequential analysis of the metal ions by forming stable complexes with some—but not all—metal ions during certain steps.
There are many masking agents, such as cyanide, fluoride, triethanolamine, thiourea, and 2,3-bis(sulfanyl)propan-1-ol (formerly 2,3-dimercapto-1-propanol), with the masking agent chosen based on...
There are many masking agents, such as cyanide, fluoride, triethanolamine, thiourea, and 2,3-bis(sulfanyl)propan-1-ol (formerly 2,3-dimercapto-1-propanol), with the masking agent chosen based on...
2.6K
Randomized Experiments
7.2K
The randomization process involves assigning study participants randomly to experimental or control groups based on their probability of being equally assigned. Randomization is meant to eliminate selection bias and balance known and unknown confounding factors so that the control group is similar to the treatment group as much as possible. A computer program and a random number generator can be used to assign participants to groups in a way that minimizes bias.
Simple randomization
Simple...
Simple randomization
Simple...
7.2K
Hindsight Biases
3.9K
Hindsight bias leads you to believe that the event you just experienced was predictable, even though it really wasn’t. In other words, you knew all along that things would turn out the way they did. Can you relate this to the phrase "Hindsight is 20/20" now?
3.9K
Types of Errors: Detection and Minimization
2.3K
Error is the deviation of the obtained result from the true, expected value or the estimated central value. Errors are expressed in absolute or relative terms.
Absolute error in a measurement is the numerical difference from the true or central value. Relative error is the ratio between absolute error and the true or central value, expressed as a percentage.
Errors can be classified by source, magnitude, and sign. There are three types of errors: systematic, random, and gross.
Systematic or...
Absolute error in a measurement is the numerical difference from the true or central value. Relative error is the ratio between absolute error and the true or central value, expressed as a percentage.
Errors can be classified by source, magnitude, and sign. There are three types of errors: systematic, random, and gross.
Systematic or...
2.3K


