多触发器投毒放大大型语言模型中的后门漏洞
Multi-Trigger Poisoning Amplifies Backdoor Vulnerabilities in LLMs
AI总结：
本研究提出多触发器投毒框架，证明LLM中多个后门可共存且高相似性触发器稳健激活，并提出基于逐层权重差异分析的选择性重训练方法以最小参数更新有效防御。
摘要：
近期研究表明，大型语言模型（LLMs）容易受到数据投毒攻击，其中恶意训练样本会嵌入由特定输入模式触发的隐藏行为。然而，大多数现有工作假设一个短语并侧重于攻击的有效性，对触发机制以及多个触发器在模型内如何相互作用的理解有限。在本文中，我们提出了一个研究LLMs中投毒的框架。我们证明，多个不同的后门触发器可以共存于单个模型中而不会相互干扰，从而使攻击者能够同时嵌入多个触发器。使用具有高嵌入相似性的多个触发器，我们证明即使令牌被替换或被长令牌跨度分隔，投毒触发器也能实现稳健激活。我们的发现暴露了LLMs中更广泛且更持久的漏洞面。为缓解这一威胁，我们提出了一种事后恢复方法，该方法基于逐层权重差异分析，选择性地重新训练特定模型组件。我们的方法以最小的参数更新有效移除触发器行为，为抵御多触发器投毒提供了一种实用且高效的防御手段。
英文摘要：
Recent studies have shown that Large Language Models (LLMs) are vulnerable to data poisoning attacks, where malicious training examples embed hidden behaviours triggered by specific input patterns. However, most existing works assume a phrase and focus on the attack's effectiveness, offering limited understanding of trigger mechanisms and how multiple triggers interact within the model. In this paper, we present a framework for studying poisoning in LLMs. We show that multiple distinct backdoor triggers can coexist within a single model without interfering with each other, enabling adversaries to embed several triggers concurrently. Using multiple triggers with high embedding similarity, we demonstrate that poisoned triggers can achieve robust activation even when tokens are substituted or separated by long token spans. Our findings expose a broader and more persistent vulnerability surface in LLMs. To mitigate this threat, we propose a post hoc recovery method that selectively retrains specific model components based on a layer-wise weight difference analysis. Our method effectively removes the trigger behaviour with minimal parameter updates, presenting a practical and efficient defence against multi-trigger poisoning.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
