Adversarial Self-Distillation

Summary

Adversarial Self-Distillation (ASD) is proposed as a defense against adversarial perturbations that bypass refusals in safety-aligned language models. The method has the model act as its own teacher on clean prompts, distilling refusal behavior to the same model under attack at the prefixes it visits, including compliant openings. ASD achieves lower attack success than state-of-the-art defenses with little loss in multiple-choice accuracy.

Mitigation

ASD: the model distills its own safe refusal behavior, given clean prompts, into its adversarially perturbed self at the prefixes it visits during on-policy sampling.

Related items

• InfoShallowDefend: Harnessing Shallow Safety Alignment for Multi-Turn DefenderSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoHow I Aligned Your Model: Scaling Up Multilingual Safety Training with TemplatesSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoTextual Response-Aware Guidance for Zero-Shot Adversarial Robustness of Vision-Language ModelsSimilar attack · Arxiv (cs.RO + cs.CV security)
• InfoLiDAR-SHIELD: A Fully Dockerized Adversarial Robustness Assessment Framework for LiDAR-Based 3D Perception ModelsSimilar attack · Arxiv (cs.RO + cs.CV security)
• InfoPASA-KV: Attacking Action-Facing Visual Routes in World Action ModelsSimilar attack · Arxiv (cs.RO + cs.CV security)