只因一个“:”，大模型全军覆没

Core Viewpoint - The article discusses a significant vulnerability in large language models (LLMs) where simple tokens, such as colons and specific phrases, can deceive these models into providing false positive rewards, highlighting the need for improved robustness in LLMs [1][21][33]. Group 1: Vulnerability Discovery - A recent study titled "A Token Can Deceive LLM" reveals that LLMs can be easily tricked by certain symbols and phrases, leading to incorrect evaluations [2][12]. - The vulnerability affects various LLMs, including GPT-4o, Claude-4, and LLaMA3-70B, which all exhibited high false positive rates (FPR) when exposed to these deceptive tokens [7][21]. - The study identified two main categories of deceptive tokens: non-character symbols (e.g., spaces, colons) and reasoning starter phrases (e.g., "Thought process:", "解") [4][15]. Group 2: Experimental Findings - All tested models, regardless of type, triggered false positive responses, with GPT-4o showing a FPR of 35% for the colon symbol and LLaMA3-70B having a FPR of 60%-90% for the phrase "Thought process:" [21][23]. - The research also indicated that model size does not consistently correlate with FPR, suggesting that larger models are not necessarily more robust against these attacks [23][26]. - The experiments demonstrated that the vulnerability could proliferate, allowing for the automatic generation of new deceptive responses based on existing "universal keys" [25]. Group 3: Mitigation Strategies - To address the identified vulnerabilities, researchers developed a new model called Master-RM, which significantly reduces the FPR to nearly zero by using an enhanced training dataset that includes adversarial samples [29][31]. - Master-RM was tested across various datasets and demonstrated robust performance, maintaining a high consistency rate with GPT-4o [32]. - The findings emphasize the importance of rigorous adversarial evaluation in the reinforcement learning from human feedback (RLHF) processes to ensure the reliability of LLMs [34][35].