针对大语言模型的复合后门攻击
Composite Backdoor Attacks Against Large Language Models
AI总结：
本文提出复合后门攻击（CBA），将多个触发键分散在不同提示组件中，仅在所有触发键同时出现时激活后门，在NLP和多模态任务上以极低中毒率实现高攻击成功率且保持模型性能，揭示了基础LLMs的安全风险。
摘要：
大语言模型（LLMs）在各种任务上表现出优于以往方法的性能，并且常常作为许多研究和服务的基础模型。然而，不可信的第三方LLMs可能会为下游任务暗中引入漏洞。本文从后门攻击的角度探讨LLMs的脆弱性。与现有针对LLMs的后门攻击不同，我们的方法将多个触发键分散在不同的提示组件中。这种复合后门攻击（CBA）被证明比将相同的多个触发键仅植入单一组件中更具隐蔽性。CBA确保只有当所有触发键都出现时后门才会被激活。我们的实验表明，CBA在自然语言处理（NLP）和多模态任务中均有效。例如，在Emotion数据集上针对LLaMA-7B模型使用3%的中毒样本，我们的攻击实现了100%的攻击成功率（ASR），误触发率（FTR）低于2.06%，且模型准确率下降可忽略不计。我们的工作凸显了加强基础LLMs可信度安全研究的必要性。
英文摘要：
Large language models (LLMs) have demonstrated superior performance compared to previous methods on various tasks, and often serve as the foundation models for many researches and services. However, the untrustworthy third-party LLMs may covertly introduce vulnerabilities for downstream tasks. In this paper, we explore the vulnerability of LLMs through the lens of backdoor attacks. Different from existing backdoor attacks against LLMs, ours scatters multiple trigger keys in different prompt components. Such a Composite Backdoor Attack (CBA) is shown to be stealthier than implanting the same multiple trigger keys in only a single component. CBA ensures that the backdoor is activated only when all trigger keys appear. Our experiments demonstrate that CBA is effective in both natural language processing (NLP) and multimodal tasks. For instance, with $3\%$ poisoning samples against the LLaMA-7B model on the Emotion dataset, our attack achieves a $100\%$ Attack Success Rate (ASR) with a False Triggered Rate (FTR) below $2.06\%$ and negligible model accuracy degradation. Our work highlights the necessity of increased security research on the trustworthiness of foundation LLMs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
