cs.CR提交于 2026-10-28已译

DYNASHIELD: 基于动态解码定制的大语言模型黑盒移动目标防御

DYNASHIELD: A Black-Box Moving Target Defense for LLMs via Dynamic Decoding Customization

Xiaoqun Liu · Weiming Qi · Qiben Yan

中文摘要

大语言模型（LLMs）仍易受越狱攻击（jailbreak attacks）影响，导致有害输出。现有防御常需访问模型内部或额外训练，限制了其在黑盒 API 部署中的适用性。DYNASHIELD 是一种移动目标防御框架，通过推理时定制解码超参数和系统提示提升鲁棒性。该框架包含两步：(1) 识别降低攻击成功率的解码配置；(2) 从加权配置池中概率采样，引入受控的行为变异性。在 7 个开源 LLM 上，针对 4 种最先进越狱攻击（使用 AdvBench 提示）进行评估。结果显示，与 7 种基线防御相比，攻击成功率显著降低，同时保持响应质量且推理开销极小。DYNASHIELD 仅通过暴露的运行时控制操作，无需重训练或模型内部访问。结果表明，安全感知的动态解码是黑盒 LLM 部署中一种有前景且轻量级的防御机制。

关键要点

01现有防御需模型内部访问或额外训练，难以适用于黑盒 API 部署场景。
02提出 DYNASHIELD 框架，通过推理时动态定制解码超参数和系统提示实现移动目标防御。
03在 7 个开源 LLM 和 4 种越狱攻击下，攻击成功率显著降低且推理开销极小。
04该方法无需重训练或模型内部访问，仅依赖暴露的运行时控制，适合黑盒部署。

解读

尚无解读。

原始英文摘要

arXiv:2412.07672v3 Announce Type: replace-cross Abstract: Large language models (LLMs) remain vulnerable to jailbreak attacks in which adversarial prompts induce harmful outputs. Existing defenses often require access to the model internals or additional training, limiting their applicability for service providers deployed through black-box APIs. In this paper, we propose DYNASHIELD, a moving target defense framework that improves robustness by customizing decoding hyperparameters and system prompts at inference time. DYNASHIELD includes two key steps: (1) it identifies decoding configurations that reduce attack success probability, and (2) it probabilistically samples from a weighted configuration pool to introduce controlled variability in model behavior. We evaluate DYNASHIELD across 7 open-source LLMs under 4 state-of-the-art jailbreak attacks, using adversarial prompts from AdvBench. Results show substantial reductions in attack success rate compared with 7 baseline defenses, while maintaining response quality and incurring minimal inference overhead. Because DYNASHIELD operates solely through exposed runtime controls, it requires no retraining or model-internal access. These results suggest that safety-aware dynamic decoding is a promising and practically lightweight defense mechanism for black-box LLM deployments.