Advancing the Robustness of Large Language Models through Self-Denoised Smoothing (2024)

Abstract: Although large language models (LLMs) have achieved significant success, their vulnerability to adversarial perturbations, including recent jailbreak attacks, has raised considerable concerns. However, the increasing size of these models and their limited access make improving their robustness a challenging task. Among various defense strategies, randomized smoothing has shown great potential for LLMs, as it does not require full access to the model’s parameters or fine-tuning via adversarial training. However, randomized smoothing involves adding noise to the input before model prediction, and the final model’s robustness largely depends on the model’s performance on these noise-corrupted data. Its effectiveness is often limited by the model’s sub-optimal performance on noisy data. To address this issue, we propose to leverage the multitasking nature of LLMs to first denoise the noisy inputs and then to make predictions based on these denoised versions. We call this procedure self-denoised smoothing. Unlike previous denoised smoothing techniques in computer vision, which require training a separate model to enhance the robustness of LLMs, our method offers significantly better efficiency and flexibility. Our experimental results indicate that our method surpasses existing methods in both empirical and certified robustness in defending against adversarial attacks for both downstream tasks and human alignments (i.e., jailbreak attacks). Our code is publicly available at https://github.com/UCSB-NLP-Chang/SelfDenoise.

## introduction large language models (llms) have demonstrated outstanding performance across various applications @xcite @xcite . however, llms are vulnerable to input-level adversarial perturbations @xcite @xcite . existing attacks are effective in generating input perturbations that can cause llms to make wrong predictions on downstream tasks or generate harmful content misaligned with human values (e.g., providing detailed instructions for creating a bomb) @xcite @xcite . this vulnerability has raised concerns about the trustworthiness of llms. enhancing the robustness of llms is very challenging. many robustness-enhancement methods @xcite @xcite involve heavy training, which can be difficult due to the enormous size of llms and limited access to their parameters (e.g., gpt models). in comparison, randomized smoothing methods @xcite @xcite offer a way to enhance the robustness with limited model access and provide stability guarantees for predictions. in the nlp field, there have been some explorations using randomized smoothing to defend against attacks on downstream tasks @xcite @xcite as well as against jailbreak attacks @xcite . however, the performance of applying randomized smoothing directly to llms remains unsatisfactory. this is primarily because randomized smoothing involves adding noise to the input, and the final model's robustness largely depends on model performance on the noise corrupted data. unfortunately, llms typically exhibit sub-optimal performance on noisy inputs. to address this issue, we propose self-denoised smoothing, or selfdenoise for short, to improve the robustness of llms based on randomized smoothing. our approach initially introduces multiple perturbed inputs by randomly masking words in the original input. unlike vanilla randomized smoothing, which directly feeds these perturbed inputs to the model, we take a further step by using the llm itself to denoise these perturbed inputs. specifically, the inputs with random masks are first fed to the llm, which is then asked to complete the sentences by filling in the masked parts. the resulting sentences are subsequently passed to the llm again for task performance. this mechanism is inspired by denoised smoothing in computer vision @xcite . however, these existing techniques typically require a separate denoising module, often trained with distinct loss functions @xcite or through black-box approaches @xcite . on the other hand, our method leverages the multitasking capabilities of llms, offering a more flexible and effective way to enhance robustness in the context of llms without the extensive costs of denoiser training. with this simple add-on step, we significantly improve the robustness of llms. we support this claim with extensive experiments on two different attack settings: defending against adversarial attacks for both downstream tasks and human alignments and measuring both empirical and certified robustness. randomized smoothing randomized smoothing @xcite @xcite is a defense strategy that converts a given classifier f (•) into a smoothed classifier g(•). given the input x, the smoothed classifier g(•) outputs the class that is most likely to be returned by f (•) given some random noise over the input. the prediction of the smoothed classifier g(•) to a class c is given by p(g(x) = c) = p(f (x ⊕ δ) = c) where x ⊕ δ indicates the noisy version of the input x and δ is the noise from a particular distribution. despite increased inference costs, randomized smoothing can both enhance empirical robustness and offer certifiable guarantees for robustness against perturbations. besides computer vision, randomized smoothing is also used in the nlp domain @xcite @xcite . smooth-llm @xcite leverages randomized smoothing to defend jailbreak attacks. our work aims to improve the effectiveness of randomized smoothing with a self-denoising framework, where llm itself is used as the denoiser to denoise the noisy versions of the input before prediction. ## methodology we denote @xmath0, x 2 , . . . , x l ] as the input to the llm f (•), where x i is the i-th token, and @xmath1. randomized smoothing we follow previous work on randomized smoothing @xcite to enhance the robustness of a llm f (•) by transforming it into a smoothed version g(•). specifically, we introduce random noise into the input by (uniform) randomly replacing some tokens with the [mask] token. the randomized masking scheme, ϕ(x, m), generates a binary sequence of the same length as the input x, with m% entries being nonzero, indicating the corresponding positions in x that will be masked. we denote the binary mask sequence as s and the masked input as m(x, s). then, the original llm selfdenoise in the randomized smoothing framework described above, the performance of the smoothed model g(•) largely depends on the llm's performance on the masked and corrupted input f (m(x, s)). to improve performance, we follow the denoise-smoothing pipeline used in computer vision (salman et al., 2020) by adding an additional denoising step with a denoiser d(•). this step in our context involves filling the masked tokens in the masked input before feeding it to the base llm, i.e., the denoiser is designed to augment the base model, making it more robust against random masks on the inputs. specifically, the denoiser has two options: ❶ instructing the llm itself to guess the masked tokens, and ❷ directly removing the masks. the choice between these two denoising operations depends on the mask rate. when the mask rate is high, the denoiser will opt to remove the masks. this is because, in such cases, guessing the masked words may result in a sentence with a different meaning or a large semantic gap compared to the original unmasked version. simply removing these masked words provides much better empirical performance. conversely, when the mask rate is low, denoising the sentence by filling in the masked words yields superior performance. in our design, we set the tipping noise rate for switching between these two denoise modes at 60%. to fill in the masked words, we simply prompt the llm and require the completed sentence to be fluent and preserve the semantics, without any training on the denoising task. the overall pipeline of our proposed selfdenoise is shown in figure 1 . certified robustness selfdenoise, being in the family of the randomized smoothing framework, can also provide certified robustness against word-replacement attacks. specifically, the llm f (•) is certified as robust if it satisfies the following condition, for any here || • || 0 represents the hamming distance, l is the number of tokens in the input, and d is known as the certification radius, which signifies the maximum allowable percentage of word perturbations without altering the model's prediction. we refer readers to @xcite for a detailed certification process and the related proof. ## conclusion in this paper, we propose a simple self-denoised smoothing technique, termed selfdenoise, to enhance the robustness of llms. the proposed method can be used as a plug-in module for any llm without requiring access to its parameters, and no training is needed. our experimental re-sults indicate that our method surpasses existing baselines in both empirical and certified robustness, effectively defending against adversarial attacks in both downstream tasks and human alignments. besides, our research contributes to the broader fields of machine learning and artificial intelligence. by tackling the challenge of robustness to noisy inputs in llms, we advance the understanding and the methodologies in this area. this can inspire further research and innovation, leading to improved techniques for enhancing the performance and reliability of llms and other machine learning models. however, it is important to acknowledge the potential biases that may exist in llms, as our method relies on them as base models. biases can arise from the training data used for llms, and these biases may be propagated by our method. we are committed to addressing the issue of biases and promoting fairness and transparency in machine learning systems. to mitigate these concerns, we will include proper licenses in the released codes and notify users about the potential risks associated with biases. this way, users can be informed and take appropriate measures to address any biases that may arise from the use of our method.