想压缩KV缓存又怕模型不安全？AnchorKV用软惩罚巧妙拒绝有害token，既省内存又防越狱，适合部署场景。
AnchorKV是一种即插即用的KV缓存压缩方法，通过构建离线安全锚点来偏置token保留分数，使其远离有害提示对应的键空间方向。该方法采用差异均值表征工程技术，在逐层键投影空间中提取拒绝方向，并引入软惩罚token选择规则。在保持压缩效率的同时，AnchorKV能显著提升LLM的安全对齐能力，抵御越狱攻击。实验表明，在适度牺牲少量性能的情况下，该方法可有效降低有害输出率。
AnchorKV: Safety-Aware KV Cache Compression via Soft Penalty with a Refusal Anchor
Large language models (LLMs) outperform earlier architectures on generative inference and long-context tasks, but their large size introduces significant challenges in memory usage, energy cost, and on-device deployment. Since scaling pre-trained language models improves downstream capability \cite{zhao2023survey}, the key-value (KV) cache becomes a dominant inference bottleneck. Recent KV cache compression methods \cite{jo2025fastkv,li2024snapkv,zhou2024dynamickv} reduce this cost by retaining only a subset of attention-relevant tokens. However, while these approaches preserve accuracy on benign workloads, their compression policies either fail to defend against jailbreak attacks \cite{jiang2024robustkv} or degrade safety alignment under aggressive eviction. We propose AnchorKV, a drop-in modification to KV cache compression that biases token retention scores away from directions in key space associated with harmful prompts. AnchorKV constructs an offline safety anchor by adapting a difference-of-means representation engineering approach \cite{arditi2024refusal,zou2023representation} to the layer-specific key projection space used in KV caching. Based on this anchor, a soft penalty token selection rule trades a small amount of utility for substantially improved safety alignment, while reducing to the original compressor when the penalty is zero.