Large Language Model Sentinel: LLM Agent for Adversarial Purification

2024-05-24

AI Summary

Large language models (LLMs) are vulnerable to textual adversarial attacks, posing critical security risks. Method: This paper proposes a proxy-based text purification framework—“LLM Guard”—that robustly repairs maliciously perturbed inputs in real time without requiring adversarial training. It introduces an instruction-driven, lightweight character-level repair module and a defense-guidance module, jointly leveraging semantics-preserving edits and adversarial interaction simulation to achieve robust equilibrium in dynamic attack-defense博弈. Contribution/Results: We pioneer the first adversarial-training-free proxy purification paradigm and propose a dual-module, lightweight, and efficient defense architecture. Experiments demonstrate substantial improvements in adversarial robustness across both open- and closed-source LLMs, achieving high defense success rates against mainstream textual attacks and boosting task accuracy by over 40% on average, while strictly preserving semantic integrity.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Safety and Robustness
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions

Abstract

Over the past two years, the use of large language models (LLMs) has advanced rapidly. While these LLMs offer considerable convenience, they also raise security concerns, as LLMs are vulnerable to adversarial attacks by some well-designed textual perturbations. In this paper, we introduce a novel defense technique named Large LAnguage MOdel Sentinel (LLAMOS), which is designed to enhance the adversarial robustness of LLMs by purifying the adversarial textual examples before feeding them into the target LLM. Our method comprises two main components: a) Agent instruction, which can simulate a new agent for adversarial defense, altering minimal characters to maintain the original meaning of the sentence while defending against attacks; b) Defense guidance, which provides strategies for modifying clean or adversarial examples to ensure effective defense and accurate outputs from the target LLMs. Remarkably, the defense agent demonstrates robust defensive capabilities even without learning from adversarial examples. Additionally, we conduct an intriguing adversarial experiment where we develop two agents, one for defense and one for attack, and engage them in mutual confrontation. During the adversarial interactions, neither agent completely beat the other. Extensive experiments on both open-source and closed-source LLMs demonstrate that our method effectively defends against adversarial attacks, thereby enhancing adversarial robustness.

Problem

• Enhancing LLM robustness against adversarial text attacks
• Purifying adversarial examples before LLM processing
• Developing defense and attack agents for adversarial testing

Innovation

• LLAMOS purifies adversarial text examples
• Agent instruction simulates defense with minimal changes
• Defense guidance modifies examples for accurate outputs