你的智能体能够防御自身免受后门攻击
Your Agent Can Defend Itself against Backdoor Attacks
AI总结：
针对 LLM 智能体训练与微调中的后门攻击，提出 ReAgent 两级一致性检测框架，利用执行与规划层面的指令-思考-行动校验显著降低攻击成功率。
摘要：
尽管由大语言模型（LLM）驱动的智能体在各个领域得到越来越广泛的采用，但它们在训练和微调期间面临来自后门攻击的重大安全风险。这些被攻陷的智能体随后可能在输入或环境中出现特定触发器时被操纵，以执行恶意操作。为应对这一紧迫风险，我们提出 ReAgent，这是一种针对基于 LLM 的智能体所遭受的一系列后门攻击的新型防御方法。直观而言，后门攻击通常会导致用户指令、智能体规划及其执行之间出现不一致。基于这一洞见，ReAgent 采用两级方法检测潜在后门。在执行层面，ReAgent 验证智能体的思考与行动之间的一致性；在规划层面，ReAgent 利用智能体根据其思考轨迹重构指令的能力，检查重构指令与用户指令之间的一致性。大量评估表明，ReAgent 在跨任务的各种后门攻击中均具有有效性。例如，在数据库操作任务中，ReAgent 将攻击成功率最高降低 90%，大幅优于现有防御方法。本工作揭示了利用被攻陷智能体自身缓解后门风险的潜力。
英文摘要：
Despite their growing adoption across domains, large language model (LLM)-powered agents face significant security risks from backdoor attacks during training and fine-tuning. These compromised agents can subsequently be manipulated to execute malicious operations when presented with specific triggers in their inputs or environments. To address this pressing risk, we present ReAgent, a novel defense against a range of backdoor attacks on LLM-based agents. Intuitively, backdoor attacks often result in inconsistencies among the user's instruction, the agent's planning, and its execution. Drawing on this insight, ReAgent employs a two-level approach to detect potential backdoors. At the execution level, ReAgent verifies consistency between the agent's thoughts and actions; at the planning level, ReAgent leverages the agent's capability to reconstruct the instruction based on its thought trajectory, checking for consistency between the reconstructed instruction and the user's instruction. Extensive evaluation demonstrates ReAgent's effectiveness against various backdoor attacks across tasks. For instance, ReAgent reduces the attack success rate by up to 90\% in database operation tasks, outperforming existing defenses by large margins. This work reveals the potential of utilizing compromised agents themselves to mitigate backdoor risks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
