通过收缩优化动力学使模型免疫于有害长时程微调
Immunizing Models Against Harmful Long-Horizon Fine-Tuning via Contractive Optimization Dynamics
为视觉基础模型（分类、生成、自回归）提供一种在发布前注入的免疫机制：通过让有害微调的优化动力学局部收缩，使攻击者即使跑数千步更新也无法有效适配有害任务，可直接用于开源视觉大模型的安全发布流程。
原文依据 we propose CLAMP (Contractive Long-horizon Attacker Mitigation via Progress-bounding), an immunization method that traps harmful fine-tuning by shaping the attacker's optimization dynamics
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论微调已成为适配强大基础模型的默认方式，但这也使得以低成本将模型改用于有害目标成为可能。现有的免疫方法试图优化局部几何或模拟短时程攻击者的训练过程，并对观测到的损失下降施加惩罚。然而在实践中，下游微调者会执行数千次更新，从而突破这些短时程防御。本文提出 CLAMP（通过进度界定实现收缩式长时程攻击缓解），这是一种免疫方法，它通过塑造攻击者的优化动力学而非仅塑造初始损失景观来困住有害微调。我们的核心思想是使有害训练在局部具有收缩性，让每一次更新都比上一次更小。这给出了攻击者在其模拟训练步数之外训练过程的闭式界。我们还引入了一种无 Hessian 的方向曲率惩罚，以沿有害下降方向构造对抗性损失景观。我们的双层目标最小化攻击者从第零步到无穷步的预测改进量。实验表明，我们的方法在分类、生成和自回归设定下均能抵御长时程微调，大幅降低有害任务的适配程度，同时保持良性效用与可微调性。
英文原文摘要 1300 字符
Fine-tuning has become the default way to adapt powerful foundation models, but this also enables low-cost repurposing for harmful objectives. Existing immunization methods try to optimize local geometry or simulate short attacker horizons, and penalize observed loss drops. However, in practice, downstream tuners run thousands of updates and overcome these short-horizon defenses.In this paper, we propose CLAMP (Contractive Long-horizon Attacker Mitigation via Progress-bounding), an immunization method that traps harmful fine-tuning by shaping the attacker's optimization dynamics rather than only the initial landscape. Our key idea is to make harmful training locally contractive, making each update smaller than the last. This yields a closed-form bound on the attacker's training beyond the attacker's simulated training steps. We also introduce a Hessian-free directional curvature penalty, to create adversarial landscapes along harmful descent directions. Our bi-level objective minimizes the attacker's predicted improvement from train step zero to infinity. Experiments show our method withstands long-horizon fine-tuning across classification, generative, and autoregressive settings, substantially reduces harmful task adaptation, while preserving benign utility and fine-tuneability.