保护多轮对话语言模型免受分布式后门触发器攻击
Securing Multi-turn Conversational Language Models From Distributed Backdoor Triggers
AI总结：
本文揭示多轮LLM可被分布在不同话语中的组合触发器激活，并提出随响应长度线性扩展的衰减对比解码，将ASR降至0.35%。
摘要：
大型语言模型（LLM）已经具备处理更长上下文长度和理解文本细微差别的能力，从而将其对话能力扩展到单一话语之外。LLM面向用户的一种流行应用是多轮聊天场景。尽管更长的聊天记忆和更好的理解看似会使用户受益，但本文揭示了一种利用多轮特性和LLM强大学习能力来伤害终端用户的漏洞：后门。我们证明LLM能够捕获组合式后门表示。只有当多个触发器同时出现时，后门才会激活。我们还通过实验验证，该表示对触发话语的位置具有不变性。随后，在5%数据的两条话语中各插入一个额外token，就可导致超过99%的攻击成功率（ASR）。使用3个触发器得到的结果表明，该框架具有可泛化性，能够以即插即用的方式兼容攻击者工具箱中的任何触发器。由于聊天场景具有巨大的输入和输出空间，防御后门可能颇具挑战。我们的分析表明，分布式后门通过使被攻击输入空间的维度呈多项式增长，加剧了当前挑战。诸如ONION和BKI等典型文本防御方法依赖辅助模型对各个token进行前向传播，其计算量随输入序列长度呈指数增长，难以维持计算可行性。为此，我们提出一种解码时防御方法——衰减对比解码（decayed contrastive decoding），其计算量随助手响应序列长度线性增长，并将后门攻击成功率降至低至0.35%。
英文摘要：
Large language models (LLMs) have acquired the ability to handle longer context lengths and understand nuances in text, expanding their dialogue capabilities beyond a single utterance. A popular user-facing application of LLMs is the multi-turn chat setting. Though longer chat memory and better understanding may seemingly benefit users, our paper exposes a vulnerability that leverages the multi-turn feature and strong learning ability of LLMs to harm the end-user: the backdoor. We demonstrate that LLMs can capture the combinational backdoor representation. Only upon presentation of triggers together does the backdoor activate. We also verify empirically that this representation is invariant to the position of the trigger utterance. Subsequently, inserting a single extra token into two utterances of 5%of the data can cause over 99% Attack Success Rate (ASR). Our results with 3 triggers demonstrate that this framework is generalizable, compatible with any trigger in an adversary's toolbox in a plug-and-play manner. Defending the backdoor can be challenging in the chat setting because of the large input and output space. Our analysis indicates that the distributed backdoor exacerbates the current challenges by polynomially increasing the dimension of the attacked input space. Canonical textual defenses like ONION and BKI leverage auxiliary model forward passes over individual tokens, scaling exponentially with the input sequence length and struggling to maintain computational feasibility. To this end, we propose a decoding time defense - decayed contrastive decoding - that scales linearly with assistant response sequence length and reduces the backdoor to as low as 0.35%.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
