arXiv 2504.056052025-04-08cs.CRcs.CL

ShadowCoT：针对大语言模型内部推理机制的隐秘推理后门攻击

ShadowCoT: Cognitive Hijacking for Stealthy Reasoning Backdoors in LLMs

School of Communication and Information Engineering, Shanghai University（上海大学通信与信息工程学院）；College of Computer Science and Information Technology, IAU（国际应用技术大学计算机科学与信息学院）；Center for AI Research (CAIR), University of Agder (UiA)（阿格德大学人工智能研究中心）

Gejian Zhao, Hanzhou Wu, Xinpeng Zhang, Athanasios V. Vasilakos

备注：: Zhao et al., 16 pages, 2025, uploaded by Hanzhou Wu, Shanghai University
发表信息：: IEEE Transactions on Information Forensics and Security (2026)

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

ShadowCoT提出一种新型攻击框架，通过操控模型认知推理路径，实现多步推理链的劫持，产生逻辑连贯但对抗性的结果，实验显示其攻击成功率高达94.4%。

摘要：

链式推理（CoT）增强了大语言模型（LLM）执行复杂推理任务的能力，但也引入了新的安全问题。本文提出ShadowCoT，一种针对LLM内部推理机制的新型后门攻击框架。与以往基于token级或提示的攻击不同，ShadowCoT直接操控模型的认知推理路径，使其能够劫持多步推理链并产生逻辑上连贯但对抗性的结果。通过条件于内部推理状态，ShadowCoT学习识别并选择性地破坏关键推理步骤，从而在目标模型中实施自我反思的认知攻击。我们的方法引入了一种轻量但有效的多阶段注入管道，通过选择性重写注意力路径并扰动中间表示，仅需0.15%的参数开销。ShadowCoT进一步利用强化学习和推理链污染（RCP）来自主合成隐秘的对抗性CoT，使其在高级防御面前保持不可检测。在多样化的推理基准和LLM上的广泛实验显示，ShadowCoT在保持良性性能的同时，实现了高达94.4%的攻击成功率和88.4%的劫持成功率。这些结果揭示了一种新兴的认知层面威胁，并突显了在浅层一致性之外需要防御的紧迫性。

英文摘要：

Chain-of-Thought (CoT) enhances an LLM's ability to perform complex reasoning tasks, but it also introduces new security issues. In this work, we present ShadowCoT, a novel backdoor attack framework that targets the internal reasoning mechanism of LLMs. Unlike prior token-level or prompt-based attacks, ShadowCoT directly manipulates the model's cognitive reasoning path, enabling it to hijack multi-step reasoning chains and produce logically coherent but adversarial outcomes. By conditioning on internal reasoning states, ShadowCoT learns to recognize and selectively disrupt key reasoning steps, effectively mounting a self-reflective cognitive attack within the target model. Our approach introduces a lightweight yet effective multi-stage injection pipeline, which selectively rewires attention pathways and perturbs intermediate representations with minimal parameter overhead (only 0.15% updated). ShadowCoT further leverages reinforcement learning and reasoning chain pollution (RCP) to autonomously synthesize stealthy adversarial CoTs that remain undetectable to advanced defenses. Extensive experiments across diverse reasoning benchmarks and LLMs show that ShadowCoT consistently achieves high Attack Success Rate (94.4%) and Hijacking Success Rate (88.4%) while preserving benign performance. These results reveal an emergent class of cognition-level threats and highlight the urgent need for defenses beyond shallow surface-level consistency.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。