---
title: "测量错误之物：内部危害分数反向排序成功的越狱攻击"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2608.09624v1"
permalink: "https://feed.astralor.com/items/itm_120f4500b947ac17f34d2a47"
published: "2026-08-10T14:05:32.000Z"
score: 78
channel: "ai"
tags: ["arXiv","AUROC","Llama","主动注意力探测","安全评测","越狱攻击"]
---

# 测量错误之物：内部危害分数反向排序成功的越狱攻击

## AI 点评

> 这篇论文让我重新审视安全评测的基石——我们验证的指标是否真的衡量了想要阻止的攻击？对模型安全团队和红队测试人员来说，它提醒我们：一个能从平均意义上区分好坏提示的分数，可能在最危险的情况上完全失灵。与其依赖单一代理指标，不如直接评估实际生成结果，或者至少用主动探针做交叉验证。

## 速览

该论文指出，内部安全分数在生成前判断提示词危害性，其验证基于对有害/良性提示的区分能力，但这种区分度并不能保证捕获真正成功的越狱攻击。作者引入主动注意力探测（Active Attention Probing），提供与内容无关的固定测量坐标，并在多个目标模型、攻击家族和评判器上验证：包装后的有害提示使有害生成率从0.05升至0.27，而有害意图AUROC从0.936降至0.803；成功攻击的AUROC仅为0.220，低于失败攻击。结果显示，衡量错误指标的安全过滤器会浪费假阳性预算在本会失败的攻击上，且分布偏移先破坏校准与阈值迁移，再影响排序。

## 关键点

- 内部安全分数衡量的是提示词的危害意图，而非越狱攻击成功率，二者存在系统性偏差。
- 主动注意力探测通过固定测量坐标，证实包装后的有害提示在生成层面更危险，但安全分数却判定其更安全。
- 成功越狱攻击与失败攻击在安全分数上出现反转（AUROC 0.220），证明分离危害意图不等于分离实际攻击结果。
- 该现象跨越多个模型、攻击家族和评判器稳定存在，且分布偏移会先损害校准和阈值迁移，再影响排序能力。

## 全文

Internal safety scores judge a prompt before any text is generated, and they are validated by how well they separate harmful prompts from benign ones. That separation is then read as evidence that the score will also catch the attacks that succeed. Harmful intent is a property of the prompt. Jailbreak success is an outcome produced later by a particular target model, decoding policy, and judge. A filter tuned on a score that measures the wrong quantity spends its false positive budget on attacks that would have failed anyway. In this paper we audit that inference. Attention based measurements are usually read from prompt dependent locations, so a wrapper changes both the content being judged and the place the signal is taken from. We therefore introduce Active Attention Probing, which supplies a fixed content independent measurement coordinate. We pair every base goal with a plain and a wrapped version and generate real completions from the target models. On Llama, wrapping raises harmful generation from 0.05 to 0.27 while harmful intent AUROC falls from 0.936 to 0.803, so the attacks grow more dangerous while the prompts look safer to the score. Among wrapped harmful prompts the outcome AUROC is 0.220, which places the attacks that succeeded below the attacks that failed. Rare token, passive, and detector derived channels reproduce the reversal on the same matched design, and the reversal itself persists across three target models, seven attack families, and two independent judges. Distribution shift then degrades calibration and threshold transfer before it degrades ranking.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_120f4500b947ac17f34d2a47