arXivDaily arXiv每日学术速递 周一至周五更新
arXiv周末暂无论文更新，休息一下吧，周末愉快~~
arXiv 2501.09798cs.CRcs.CL
收藏

Fun-tuning：通过微调接口刻画专有 LLM 对基于优化的提示注入攻击的脆弱性

Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface

UC San Diego（加州大学圣地亚哥分校）；University of Wisconsin Madison（威斯康星大学麦迪逊分校）

Andrey Labunets, Nishit V. Pandya, Ashish Hooda, Xiaohan Fu, Earlence Fernandes

发表信息：
Proceedings of the 2025 IEEE Symposium on Security and Privacy, IEEE Computer Society, 2025, pp. 374-392
阅读 PDF
arXiv 页面 ↗HTML 原文 ↗

AI总结：

论文揭示闭源 LLM 微调接口泄露的类损失信号可被贪心搜索用于生成对抗性提示，并在 Gemini 系列上以 PurpleLlama 基准实现 65%–82% 攻击成功率。

摘要：

我们揭示了针对闭权重大型语言模型（LLM）的一种新威胁，它使攻击者能够计算基于优化的提示注入。具体而言，我们刻画了攻击者如何利用远程微调接口返回的类损失信息来引导对抗性提示的搜索。该微调接口由 LLM 供应商托管，允许开发者为其任务微调 LLM，因而提供了实用性，但同时也暴露了足够信息，使攻击者能够计算对抗性提示。通过实验分析，我们刻画了 Gemini 微调 API 返回的类损失值，并证明它们为使用贪心搜索算法对对抗性提示进行离散优化提供了有用信号。利用 PurpleLlama 提示注入基准，我们在 Google 的 Gemini 系列 LLM 上展示了 65% 至 82% 的攻击成功率。这些攻击利用了经典的实用性—安全性权衡：微调接口为开发者提供了有用功能，但也使 LLM 暴露于强大攻击之下。

英文摘要：

We surface a new threat to closed-weight Large Language Models (LLMs) that enables an attacker to compute optimization-based prompt injections. Specifically, we characterize how an attacker can leverage the loss-like information returned from the remote fine-tuning interface to guide the search for adversarial prompts. The fine-tuning interface is hosted by an LLM vendor and allows developers to fine-tune LLMs for their tasks, thus providing utility, but also exposes enough information for an attacker to compute adversarial prompts. Through an experimental analysis, we characterize the loss-like values returned by the Gemini fine-tuning API and demonstrate that they provide a useful signal for discrete optimization of adversarial prompts using a greedy search algorithm. Using the PurpleLlama prompt injection benchmark, we demonstrate attack success rates between 65% and 82% on Google's Gemini family of LLMs. These attacks exploit the classic utility-security tradeoff - the fine-tuning interface provides a useful feature for developers but also exposes the LLMs to powerful attacks.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

↑