指令微调语言模型中的后门研究
A Study of Backdoors in Instruction Fine-tuned Language Models
AI总结：
本文研究了指令微调LLM中后门数据投毒攻击在不同超参数下的有效性，并提出基于词频统计的微调中防御和基于下游干净微调的微调后防御两种防御措施。
摘要：
插入到用于微调基础大型语言模型（LLM）以执行下游任务（例如，情感预测）的指令样本中的后门数据投毒，由于此类攻击的隐蔽性，是一个严重的安全隐患。这种投毒通常以（看似无害的）触发词或短语的形式，插入到来自目标类别的极小部分微调样本中。此类后门攻击可以：改变响应情感、违反审查、过度拒绝（对合法查询调用审查）、注入虚假内容，或引发无意义的响应（幻觉）。在本研究中，我们探讨了在不同场景下，随着攻击“超参数”的变化，指令微调后门攻击的有效性，考虑因素包括：中毒样本中的触发位置；在测试时对触发位置改变、部分触发和同义词替换的鲁棒性；从一个（微调）域到相关测试域的攻击迁移；以及干净标签与脏标签投毒。基于我们的观察，我们提出并评估了两种针对此类攻击的防御措施：i) 一种基于词频统计的微调中防御，假设（可能被投毒的）微调数据集可用，并识别后门触发标记；ii) 一种基于使用小型防御数据集对带后门的LLM进行下游干净微调的微调后防御。最后，我们对后门攻击和防御的相关工作进行了简要综述。
英文摘要：
Backdoor data poisoning, inserted within instruction examples used to fine-tune a foundation Large Language Model (LLM) for downstream tasks (\textit{e.g.,} sentiment prediction), is a serious security concern due to the evasive nature of such attacks. The poisoning is usually in the form of a (seemingly innocuous) trigger word or phrase inserted into a very small fraction of the fine-tuning samples from a target class. Such backdoor attacks can: alter response sentiment, violate censorship, over-refuse (invoke censorship for legitimate queries), inject false content, or trigger nonsense responses (hallucinations). In this work we investigate the efficacy of instruction fine-tuning backdoor attacks as attack "hyperparameters" are varied under a variety of scenarios, considering: the trigger location in the poisoned examples; robustness to change in the trigger location, partial triggers, and synonym substitutions at test time; attack transfer from one (fine-tuning) domain to a related test domain; and clean-label vs. dirty-label poisoning. Based on our observations, we propose and evaluate two defenses against these attacks: i) a \textit{during-fine-tuning defense} based on word-frequency counts that assumes the (possibly poisoned) fine-tuning dataset is available and identifies the backdoor trigger tokens; and ii) a \textit{post-fine-tuning defense} based on downstream clean fine-tuning of the backdoored LLM with a small defense dataset. Finally, we provide a brief survey of related work on backdoor attacks and defenses.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
