未来事件作为后门触发器：探究LLM中的时间漏洞
Future Events as Backdoor Triggers: Investigating Temporal Vulnerabilities in LLMs
AI总结：
本研究提出利用未来事件作为LLM后门触发器的时间漏洞，发现模型能区分时间且后门可被时间分布偏移激活，同时验证了HHH微调等标准安全措施在适度规模模型上能有效移除此类后门。
摘要：
后门是仅在AI系统部署后才会被触发的隐藏行为。企图制造成功后门的恶意行为者必须精心设计后门，使其在训练和评估期间避免被激活。由于这些阶段使用的数据通常仅包含已经发生事件的信息，一个简单的后门触发器组件可以是模型识别出相对于其训练时间属于未来的数据。通过提示实验和探测内部激活，我们表明当前的大型语言模型（LLM）能够区分过去与未来的事件，对模型激活的探测达到了90%的准确率。我们训练了由时间分布偏移触发的后门模型；当模型暴露于其训练截止日期之后的新闻标题时，后门会被激活。在有用、无害和诚实（HHH）数据上进行微调对于移除较简单的后门触发器效果不佳，但对我们的后门模型很有效，尽管这种区别在我们测试的较大规模模型上较小。我们还发现，代表模型对日期内部表示的激活引导向量会影响后门激活率。我们将这些结果视为初步证据，表明至少对于我们测试的适度规模模型，标准安全措施足以移除这些后门。
英文摘要：
Backdoors are hidden behaviors that are only triggered once an AI system has been deployed. Bad actors looking to create successful backdoors must design them to avoid activation during training and evaluation. Since data used in these stages often only contains information about events that have already occurred, a component of a simple backdoor trigger could be a model recognizing data that is in the future relative to when it was trained. Through prompting experiments and by probing internal activations, we show that current large language models (LLMs) can distinguish past from future events, with probes on model activations achieving 90% accuracy. We train models with backdoors triggered by a temporal distributional shift; they activate when the model is exposed to news headlines beyond their training cut-off dates. Fine-tuning on helpful, harmless and honest (HHH) data does not work well for removing simpler backdoor triggers but is effective on our backdoored models, although this distinction is smaller for the larger-scale model we tested. We also find that an activation-steering vector representing a model's internal representation of the date influences the rate of backdoor activation. We take these results as initial evidence that, at least for models at the modest scale we test, standard safety measures are enough to remove these backdoors.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
