Large language models (LLMs) are increasingly being adopted in a wide range
of real-world applications. Despite their impressive performance, recent
studies have shown that LLMs are vulnerable to deliberately crafted adversarial
prompts even when aligned via Reinforcement Learning from Human Feedback or
supervised fine-tuning. While existing defense methods focus on either
detecting harmful prompts or reducing the likelihood of harmful responses
through various means, defending LLMs against jailbreak attacks based on the
inner mechanisms of LLMs remains largely unexplored. In this work, we
investigate how LLMs response to harmful prompts and propose a novel defense
method termed \textbf{L}ayer-specific \textbf{Ed}iting (LED) to enhance the
resilience of LLMs against jailbreak attacks. Through LED, we reveal that
several critical \textit{safety layers} exist among the early layers of LLMs.
We then show that realigning these safety layers (and some selected additional
layers) with the decoded safe response from selected target layers can
significantly improve the alignment of LLMs against jailbreak attacks.
Extensive experiments across various LLMs (e.g., Llama2, Mistral) show the
effectiveness of LED, which effectively defends against jailbreak attacks while
maintaining performance on benign prompts. Our code is available at
https://github.com/ledllm/ledllm.

通过 Layer-specific Editing (LED) 方法，本研究探讨了大型语言模型（LLMs）对有害提示的反应，并显示出早期层中存在几个关键的安全层。通过将这些安全层与来自选择目标层的解码安全响应进行重新对齐，可以显著提高 LLMs 对破解攻击的适应性。