探索聊天模型的后门漏洞
Exploring Backdoor Vulnerabilities of Chat Models
AI总结：
本文揭示并实现了一种针对聊天模型的新型后门攻击方法，通过将多个触发场景分散在多轮对话中并在全部出现时激活后门，在保持正常能力的同时实现高攻击成功率且难以被下游重新对齐移除。
摘要：
近期研究表明，大型语言模型（LLMs）容易受到一种被称为后门攻击的安全威胁。被植入后门的模型在正常情形下表现良好，但在输入中插入特定后门触发器时则会表现出恶意行为。当前针对LLMs的后门研究主要集中于经过指令微调的LLMs，而忽视了另一种现实场景，即LLMs在多轮对话数据上进行微调以成为聊天模型。聊天模型被广泛应用于各种现实场景，因此聊天模型的安全性值得越来越多的关注。遗憾的是，我们指出，灵活的多轮交互形式反而增加了触发器设计的灵活性，并放大了聊天模型对后门攻击的脆弱性。在这项工作中，我们揭示并实现了一种新颖的聊天模型后门攻击方法，通过将多个触发场景分布在不同轮次的用户输入中，并且仅当所有触发场景都已出现在历史对话中时才触发后门。实验结果表明，我们的方法能够实现较高的攻击成功率（例如，在Vicuna-7B上超过90%的ASR），同时成功保持聊天模型在向良性用户请求提供有用回复方面的正常能力。此外，该后门无法通过下游重新对齐轻易移除，这凸显了对聊天模型安全问题持续研究和关注的重要性。警告：本文可能包含有害内容。
英文摘要：
Recent researches have shown that Large Language Models (LLMs) are susceptible to a security threat known as Backdoor Attack. The backdoored model will behave well in normal cases but exhibit malicious behaviours on inputs inserted with a specific backdoor trigger. Current backdoor studies on LLMs predominantly focus on instruction-tuned LLMs, while neglecting another realistic scenario where LLMs are fine-tuned on multi-turn conversational data to be chat models. Chat models are extensively adopted across various real-world scenarios, thus the security of chat models deserves increasing attention. Unfortunately, we point out that the flexible multi-turn interaction format instead increases the flexibility of trigger designs and amplifies the vulnerability of chat models to backdoor attacks. In this work, we reveal and achieve a novel backdoor attacking method on chat models by distributing multiple trigger scenarios across user inputs in different rounds, and making the backdoor be triggered only when all trigger scenarios have appeared in the historical conversations. Experimental results demonstrate that our method can achieve high attack success rates (e.g., over 90% ASR on Vicuna-7B) while successfully maintaining the normal capabilities of chat models on providing helpful responses to benign user requests. Also, the backdoor can not be easily removed by the downstream re-alignment, highlighting the importance of continued research and attention to the security concerns of chat models. Warning: This paper may contain toxic content.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
