Representation noising effectively prevents harmful fine-tuning on LLMs
<|reference_start|>Representation noising effectively prevents harmful fine-tuning on LLMs: Releasing open-source large language models (LLMs) presents a dual-use risk since bad actors can easily fine-tune these models for harmful purposes. Even without the open release of weights, weight stealing and fine-tuning APIs make closed models vulnerable to harmful fine-tuning attacks (HFAs). While safety measures like preventing jailbreaks and improving safety guardrails are important, such measures can easily be reversed through fine-tuning. In this work, we propose Representation Noising (RepNoise), a defence mechanism that is effective even when attackers have access to the weights. RepNoise works by removing information about harmful representations such that it is difficult to recover them during fine-tuning. Importantly, our defence is also able to generalize across different subsets of harm that have not been seen during the defence process as long as they are drawn from the same distribution of the attack set. Our method does not degrade the general capability of LLMs and retains the ability to train the model on harmless tasks. We provide empirical evidence that the effectiveness of our defence lies in its "depth": the degree to which information about harmful representations is removed across all layers of the LLM.<|reference_end|>
@article{rosati2024representation,
    title={Representation Noising: A Defence Mechanism Against Harmful Finetuning},
    author={Domenic Rosati, Jan Wehner, Kai Williams, {L}ukasz Bartoszcze, David
  Atanasov, Robie Gonzales, Subhabrata Majumdar, Carsten Maple, Hassan Sajjad,
  Frank Rudzicz},
    journal={arXiv preprint arXiv:2405.14577},
    year={2024},
    archivePrefix={arXiv},
    eprint={2405.14577},
    primaryClass={cs.CL cs.LG}
}