arXiv：cs.AI· Yisong Xiao, Benlei Cui, Haiwen Hong, Shiji Zhao, Zonghao Ying, Yaoyuan Zhang, Longtao Huang, Aishan Liu, Hui Xue, Ting Ma, Xianglong Liu·· 16 小时前
PASP：用感知感知对抗自博弈提升 LLM 对有害内容的理解
Hidden in Plain Sight: Advancing Harmful Content Understanding via Perception-Aware Adversarial Self-Play
AI 导读
针对 LLM 难以识别人为伪装的有害内容，研究者提出 PASP（Perception-Aware Adversarial Self-Play），通过构建文本、语音、视觉三种视图并结合对抗自博弈来理解有害意图。实验显示，PASP 在 ChineseHarm-Bench 和 EvoHarmBench 上分别将自适应攻击成功率降低最多 73.71% 和 74.49%，且模型能力仅有极小下降。
正文
Authors:Yisong Xiao, Benlei Cui, Haiwen Hong, Shiji Zhao, Zonghao Ying, Yaoyuan Zhang, Longtao Huang, Aishan Liu, Hui Xue, Ting Ma, Xianglong Liu
Abstract:Despite significant advances in language understanding, Large Language Models (LLMs) can still miss meaning hidden in plain sight, failing to identify harmful intent in expressions readily understood by humans. Malicious users exploit this gap by strategically disguising harmful content to evade automated moderation, posing a serious threat to online platform safety. The vulnerability reflects a fundamental cognitive asymmetry between human readers, who integrate contextual, phonetic, and visual cues to decipher the intent behind deliberate obfuscation, and text-based LLMs, which rely primarily on token sequences and have limited exposure to evolving evasions. To bridge this asymmetry, we propose PASP (Perception-Aware Adversarial Self-Play), which combines multi-perceptual views with adversarial self-play to improve understanding of harmful intent as evasions evolve. Specifically, PASP constructs textual, phonetic, and visual views of each input, preserving its original context while exposing pronunciation and glyph cues obscured in token space. During adversarial self-play, an attacker uses defender feedback to generate intent-preserving evasions, while the defender is trained using an intent-invariance reward to understand harmful intent across changing surface forms. Extensive experiments show that PASP reduces adaptive attack success rates by up to 73.71% and 74.49% on ChineseHarm-Bench and EvoHarmBench, respectively, preserves model capabilities with minimal degradation, and effectively interprets real-world evasive expressions in e-commerce.
| Subjects: | Artificial Intelligence (cs.AI); Computation and Language (cs.CL) |
| Cite as: | arXiv:2610.15449 [cs.AI] |
| (or arXiv:2610.15449v2 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2610.15449 arXiv-issued DOI via DataCite |
Submission history
From: Yisong Xiao [view email]
[v1]
Sun, 11 Oct 2026 08:50:07 UTC (2,277 KB)
[v2]
Wed, 14 Oct 2026 11:58:17 UTC (2,279 KB)
来源：arXiv：cs.AI · arxiv.org