当后门发声：通过模型生成的解释理解 LLM 后门攻击
When Backdoors Speak: Understanding LLM Backdoor Attacks Through Model-Generated Explanations
AI总结：
本文利用 LLM 为自身决策生成自然语言解释，比较干净与有毒输入，揭示后门模型在 token 层和注意力层面的异常解释机制，并提出可解释性检测框架。
摘要：
大型语言模型（LLM）已知容易受到后门攻击，在这类攻击中，嵌入有毒样本的触发器会恶意改变 LLM 的行为。本文中，我们不再局限于攻击 LLM，而是通过自然语言解释这一新颖视角来审视后门攻击。具体而言，我们利用 LLM 的生成能力为其决策生成人类可读的解释，从而能够直接比较干净样本与有毒样本的解释。结果表明，被植入后门的模型会为干净输入生成连贯解释，但对有毒数据生成多样且存在逻辑缺陷的解释；在分类和生成任务中，针对不同后门攻击，这一模式均保持一致。进一步分析揭示了关于解释生成过程的关键洞见。在 token 层面，与有毒样本相关的解释 token 只出现在最后几个 transformer 层。在句子层面，注意力动态表明，有毒输入在解释生成期间会使注意力偏离原始输入上下文。这些发现增进了我们对 LLM 中后门机制的理解，并提供了一个通过可解释性检测漏洞的有前景框架。
英文摘要：
Large Language Models (LLMs) are known to be vulnerable to backdoor attacks, where triggers embedded in poisoned samples can maliciously alter LLMs' behaviors. In this paper, we move beyond attacking LLMs and instead examine backdoor attacks through the novel lens of natural language explanations. Specifically, we leverage LLMs' generative capabilities to produce human-readable explanations for their decisions, enabling direct comparisons between explanations for clean and poisoned samples. Our results show that backdoored models produce coherent explanations for clean inputs but diverse and logically flawed explanations for poisoned data, a pattern consistent across classification and generation tasks for different backdoor attacks. Further analysis reveals key insights into the explanation generation process. At the token level, explanation tokens associated with poisoned samples only appear in the final few transformer layers. At the sentence level, attention dynamics indicate that poisoned inputs shift attention away from the original input context during explanation generation. These findings enhance our understanding of backdoor mechanisms in LLMs and present a promising framework for detecting vulnerabilities through explainability.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
