TuBA：指令微调大语言模型中后门攻击的跨语言可迁移性
TuBA: Cross-Lingual Transferability of Backdoor Attacks in LLMs with Instruction Tuning
AI总结：
本文提出 TuBA，通过污染一至两种语言的指令微调数据实现跨语言后门迁移，在 mT5、GPT-4o、Llama 等模型上验证其高成功率、跨 26 种语言的可迁移性及防御后鲁棒性。
摘要：
后门攻击对以英语为中心的大语言模型（LLM）的影响已得到广泛研究——此类攻击可通过在训练期间植入恶意行为实现，并在触发恶意输出的特定条件下被激活。尽管开源和专有 LLM 对多语言能力的支持不断增强，但后门攻击对这些系统的影响仍基本未被探索。我们的研究聚焦针对多语言 LLM 的跨语言后门攻击，重点考察污染一种或两种语言的指令微调数据，会如何影响指令微调数据未被污染的语言的输出。尽管方法简单，我们的实证分析表明，该方法在 mT5 和 GPT-4o 等模型中表现出显著效果，攻击成功率很高：在多种场景下，12 种语言中有超过 7 种的攻击成功率超过 90%。研究结果还表明，能力更强的模型更容易受到可迁移跨语言后门攻击的影响；这一规律同样适用于主要以英语数据预训练的 LLM，例如 Llama2、Llama3 和 Gemma。此外，实验证明：1）高可迁移性：后门机制可在覆盖 26 种语言的跨语言响应场景中成功运行，平均攻击成功率达到 99%；2）鲁棒性：所提出的攻击即使在应用防御措施后仍然有效。这些发现揭示了多语言 LLM 中的关键安全漏洞，并凸显迫切需要更鲁棒、更有针对性的防御策略，以应对跨语言后门迁移带来的独特挑战。
英文摘要：
The implications of backdoor attacks on English-centric large language models (LLMs) have been widely examined - such attacks can be achieved by embedding malicious behaviors during training and activated under specific conditions that trigger malicious outputs. Despite the increasing support for multilingual capabilities in open-source and proprietary LLMs, the impact of backdoor attacks on these systems remains largely under-explored. Our research focuses on cross-lingual backdoor attacks against multilingual LLMs, particularly investigating how poisoning the instruction-tuning data for one or two languages can affect the outputs for languages whose instruction-tuning data were not poisoned. Despite its simplicity, our empirical analysis reveals that our method exhibits remarkable efficacy in models like mT5 and GPT-4o, with high attack success rates, surpassing 90% in more than 7 out of 12 languages across various scenarios. Our findings also indicate that more powerful models show increased susceptibility to transferable cross-lingual backdoor attacks, which also applies to LLMs predominantly pre-trained on English data, such as Llama2, Llama3, and Gemma. Moreover, our experiments demonstrate 1) High Transferability: the backdoor mechanism operates successfully in cross-lingual response scenarios across 26 languages, achieving an average attack success rate of 99%, and 2) Robustness: the proposed attack remains effective even after defenses are applied. These findings expose critical security vulnerabilities in multilingual LLMs and highlight the urgent need for more robust, targeted defense strategies to address the unique challenges posed by cross-lingual backdoor transfer.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
