AnchorRep 用表示排斥防御 LLM 跨模型对抗迁移攻击
AnchorRep: Defending LLMs Against Cross-Model Adversarial Transfer via Representation Repulsion
AI 导读
论文提出 AnchorRep，用轻量 LoRA 适配器把被防御模型对有害提示的内部表示推离冻结锚模型，无需对抗样本即可削弱跨模型对抗迁移。在 5 个模型、4 个架构家族的 2,000 个迁移攻击上，攻击成功率降至 <=1.1%，Mistral 从 36% 降至 1.1%。
推荐理由
论文给出跨模型对抗迁移的防御新思路，用表示几何而非对抗训练，并补充了现有防御的隐性代价与可复现代码。
正文 · 原文
Abstract:Adversarial attacks optimized on a single open-weight LLM can transfer to and jailbreak architecturally different models, allowing an attacker with white-box access to one model to compromise independently deployed systems. This creates a shared vulnerability across models, yet existing defenses are not designed for this cross-model threat. We find that cross-model transfer aligns with shared internal representation geometry, making it a natural defense target. AnchorRep targets this geometry directly with a lightweight LoRA adapter that pushes the defended model's internal representations of harmful prompts away from those of a frozen anchor model on the same prompts. Training uses a small set of harmful prompts and no adversarial examples. Across five models and four architectural families, AnchorRep reduces cross-model attack success rate to <=1.1% on 2,000 transferred attacks (0% on two), including the largest drop on Mistral (36% -> 1.1%). Existing defenses can reduce transfer, but only at high cost either inducing up to 77% degenerate benign output or increasing over-refusal by up to 18%. Because such degenerate benign outputs are not captured by standard refusal-based metrics, we introduce the Benign Garble Rate to quantify them. Our results suggest that cross-model robustness can be achieved by shaping representation geometry, without requiring attack-specific training
| Comments: | NeurIPS 2026; Code, configs and logs: this https URL |
| Subjects: | Machine Learning (cs.LG); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2609.32602 [cs.LG] |
| (or arXiv:2609.32602v2 [cs.LG] for this version) | |
| https://doi.org/10.48550/arXiv.2609.32602 arXiv-issued DOI via DataCite |
Submission history
From: Gal Wertheizer [view email]
[v1]
Sat, 26 Sep 2026 13:19:52 UTC (142 KB)
[v2]
Wed, 4 Nov 2026 16:58:49 UTC (146 KB)
来源：arXiv cs.AI · arxiv.org