标题： 为什么通用对抗攻击在大型语言模型上有效？ ：几何学可能是答案 显示英文标题

标题： Why do universal adversarial attacks work on large language models?: Geometry might be the answer

摘要： 基于Transformer的大语言模型具有涌现能力，在社会中变得越来越普遍。 然而，在对抗攻击的背景下，理解并解释其内部工作机制的任务仍然 largely 未解决。 基于梯度的通用对抗攻击已被证明对大语言模型非常有效，并且由于其输入无关的特性，可能具有潜在危险性。 这项工作提出了一个新颖的几何视角，用于解释大语言模型上的通用对抗攻击。 通过攻击117M参数的GPT-2模型，我们找到了证据，表明通用对抗触发器可能是仅近似其对抗训练区域中语义信息的嵌入向量。 这一假设得到了包含降维和隐藏表示相似性测量的白盒模型分析的支持。 我们认为，这种对驱动通用攻击的基本机制的新几何视角，可以帮助我们更深入地了解大语言模型的内部工作机制和失败模式，从而实现对其的缓解。 显示英文摘要

摘要： Transformer based large language models with emergent capabilities are becoming increasingly ubiquitous in society. However, the task of understanding and interpreting their internal workings, in the context of adversarial attacks, remains largely unsolved. Gradient-based universal adversarial attacks have been shown to be highly effective on large language models and potentially dangerous due to their input-agnostic nature. This work presents a novel geometric perspective explaining universal adversarial attacks on large language models. By attacking the 117M parameter GPT-2 model, we find evidence indicating that universal adversarial triggers could be embedding vectors which merely approximate the semantic information in their adversarial training region. This hypothesis is supported by white-box model analysis comprising dimensionality reduction and similarity measurement of hidden representations. We believe this new geometric perspective on the underlying mechanism driving universal attacks could help us gain deeper insight into the internal workings and failure modes of LLMs, thus enabling their mitigation.