利用情境后门攻击危害具身智能体
Compromising Embodied Agents with Contextual Backdoor Attacks
AI总结：
本文提出 \method{} 情境后门攻击，仅通过投毒少量上下文示范，即可让黑盒 LLM 生成由文本与视觉触发器激活的缺陷程序，并在机器人与自动驾驶任务中验证其威胁。
摘要：
大语言模型（LLM）已经改变了具身智能的开发方式。通过提供少量上下文示范，开发者可以利用 LLM 丰富的内部知识，轻松地将以抽象语言描述的复杂任务转换为代码片段序列，而这些代码片段将作为具身智能体的执行逻辑。然而，本文揭示了这一过程中一个重大的后门安全威胁，并提出了一种名为 \method{} 的新方法。攻击者只需毒害少量上下文示范，就可以隐蔽地破坏黑盒 LLM 的上下文环境，促使其生成具有情境依赖缺陷的程序。这些程序看似逻辑合理，但当运行中的智能体在其交互环境中遇到特定触发器时，其中的缺陷便会被激活并诱发非预期行为。为了破坏 LLM 的上下文环境，我们采用对抗性上下文内生成来优化被投毒的示范：由一个 LLM 评判者评估这些被投毒的提示，并向另一个 LLM 反馈，后者在双人对抗博弈中利用思维链推理迭代优化示范。为了使下游智能体产生情境依赖行为，我们实施了一种双模态激活策略，通过文本和视觉触发器同时控制程序缺陷的生成与执行。我们还开发了五种程序缺陷模式，扩大了攻击范围，这些模式会危害具身智能体在保密性、完整性和可用性方面的关键属性。为验证该方法的有效性，我们在机器人规划、机器人操作和组合视觉推理等多种任务上进行了大量实验。此外，我们还通过成功攻击真实世界中的自动驾驶系统，展示了该方法的潜在影响。
英文摘要：
Large language models (LLMs) have transformed the development of embodied intelligence. By providing a few contextual demonstrations, developers can utilize the extensive internal knowledge of LLMs to effortlessly translate complex tasks described in abstract language into sequences of code snippets, which will serve as the execution logic for embodied agents. However, this paper uncovers a significant backdoor security threat within this process and introduces a novel method called \method{}. By poisoning just a few contextual demonstrations, attackers can covertly compromise the contextual environment of a black-box LLM, prompting it to generate programs with context-dependent defects. These programs appear logically sound but contain defects that can activate and induce unintended behaviors when the operational agent encounters specific triggers in its interactive environment. To compromise the LLM's contextual environment, we employ adversarial in-context generation to optimize poisoned demonstrations, where an LLM judge evaluates these poisoned prompts, reporting to an additional LLM that iteratively optimizes the demonstration in a two-player adversarial game using chain-of-thought reasoning. To enable context-dependent behaviors in downstream agents, we implement a dual-modality activation strategy that controls both the generation and execution of program defects through textual and visual triggers. We expand the scope of our attack by developing five program defect modes that compromise key aspects of confidentiality, integrity, and availability in embodied agents. To validate the effectiveness of our approach, we conducted extensive experiments across various tasks, including robot planning, robot manipulation, and compositional visual reasoning. Additionally, we demonstrate the potential impact of our approach by successfully attacking real-world autonomous driving systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
