BadLingual：一种针对大语言模型的新型语言后门攻击
BadLingual: A Novel Lingual-Backdoor Attack against Large Language Models
AI总结：
本文提出语言后门攻击，并设计任务无关的BadLingual方法，利用PGCG对抗训练扩大决策边界，显著提升跨任务攻击成功率，揭示多语言LLMs的安全漏洞。
摘要：
本文提出了一种针对大语言模型（LLMs）的新型后门攻击形式：语言后门攻击。语言后门攻击的关键创新在于，语言本身充当触发器，劫持被感染的LLMs以生成煽动性言论。它们能够精确瞄准特定语言使用群体，加剧恶意实体造成的种族歧视。我们首先实现了一种基线语言后门攻击，该攻击通过将特定下游任务的一组训练数据翻译成触发语言来进行投毒。然而，这种基线攻击存在任务泛化能力差的问题，在现实场景中不切实际。为应对这一挑战，我们设计了BadLingual，一种新颖的任务无关的语言后门，能够在聊天LLMs中触发任何下游任务，无论这些任务的具体问题是什么。我们设计了一种新方法，使用基于PPL约束的贪婪坐标梯度搜索（PGCG）的对抗训练来扩展语言后门的决策边界，从而增强语言后门跨各种任务的泛化能力。我们进行了大量实验以验证所提攻击的有效性。具体而言，基线攻击在指定任务上实现了超过90%的攻击成功率（ASR）。然而，在任务无关场景下，其在六个任务上的ASR仅为37.61%。相比之下，BadLingual比基线提升了高达37.35%。我们的研究揭示了具有多语言能力的LLMs中漏洞的新视角，并有望推动未来关于潜在防御的研究，以增强LLMs的鲁棒性。
英文摘要：
In this paper, we present a new form of backdoor attack against Large Language Models (LLMs): lingual-backdoor attacks. The key novelty of lingual-backdoor attacks is that the language itself serves as the trigger to hijack the infected LLMs to generate inflammatory speech. They enable the precise targeting of a specific language-speaking group, exacerbating racial discrimination by malicious entities. We first implement a baseline lingual-backdoor attack, which is carried out by poisoning a set of training data for specific downstream tasks through translation into the trigger language. However, this baseline attack suffers from poor task generalization and is impractical in real-world settings. To address this challenge, we design BadLingual, a novel task-agnostic lingual-backdoor, capable of triggering any downstream tasks within the chat LLMs, regardless of the specific questions of these tasks. We design a new approach using PPL-constrained Greedy Coordinate Gradient-based Search (PGCG) based adversarial training to expand the decision boundary of lingual-backdoor, thereby enhancing the generalization ability of lingual-backdoor across various tasks. We perform extensive experiments to validate the effectiveness of our proposed attacks. Specifically, the baseline attack achieves an ASR of over 90% on the specified tasks. However, its ASR reaches only 37.61% across six tasks in the task-agnostic scenario. In contrast, BadLingual brings up to 37.35% improvement over the baseline. Our study sheds light on a new perspective of vulnerabilities in LLMs with multilingual capabilities and is expected to promote future research on the potential defenses to enhance the LLMs' robustness
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
