小心你的生成引导！探索针对大语言模型的条件后门攻击
Watch Out for Your Guidance on Generation! Exploring Conditional Backdoor Attacks against Large Language Models
AI总结：
本文提出 BrieFool 条件后门攻击框架，利用用户指定的生成条件隐蔽触发 LLM，在安全失配和能力退化两类目标上均取得高攻击成功率。
摘要：
针对大语言模型（LLM）的主流后门攻击通常在输入样本中设置固定触发器，并为被触发的查询指定特定响应。然而，固定触发器设置（例如不常见的词语）可能很容易被人工检测发现，从而限制其在真实场景中的有效性和实用性。为增强后门激活的隐蔽性，我们提出了一种针对 LLM 的新型投毒范式，该范式通过指定生成条件来触发，而生成条件是用户在模型推理期间普遍采用的策略。被投毒模型在正常或其他生成条件下输出表现正常，而在目标生成条件下会产生有害输出。为实现这一目标，我们提出 BrieFool，这是一个高效攻击框架。它利用生成条件的特征，通过高效的指令采样和投毒数据生成，影响 LLM 在目标条件下的行为。我们的攻击根据不同目标通常可分为两类：安全失配攻击和能力退化攻击。大量实验表明，BrieFool 在安全领域和能力领域均有效，取得了高于基线方法的成功率，在 GPT-3.5-turbo 上达到 94.3%。
英文摘要：
Mainstream backdoor attacks on large language models (LLMs) typically set a fixed trigger in the input instance and specific responses for triggered queries. However, the fixed trigger setting (e.g., unusual words) may be easily detected by human detection, limiting the effectiveness and practicality in real-world scenarios. To enhance the stealthiness of backdoor activation, we present a new poisoning paradigm against LLMs triggered by specifying generation conditions, which are commonly adopted strategies by users during model inference. The poisoned model performs normally for output under normal/other generation conditions, while becomes harmful for output under target generation conditions. To achieve this objective, we introduce BrieFool, an efficient attack framework. It leverages the characteristics of generation conditions by efficient instruction sampling and poisoning data generation, thereby influencing the behavior of LLMs under target conditions. Our attack can be generally divided into two types with different targets: Safety unalignment attack and Ability degradation attack. Our extensive experiments demonstrate that BrieFool is effective across safety domains and ability domains, achieving higher success rates than baseline methods, with 94.3 % on GPT-3.5-turbo
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
