arXiv 2508.015542025-08-03cs.CLcs.AIcs.CR

所有提示组件都是价值中立的吗？理解大语言模型中解剖提示的异构对抗鲁棒性

Are All Prompt Components Value-Neutral? Understanding the Heterogeneous Adversarial Robustness of Dissected Prompt in Large Language Models

Duke University（杜克大学）；North China University of Technology（北方工业大学）；Hong Kong Polytechnic University（香港理工大学）；Australian National University（澳大利亚国立大学）；Nanyang Technological University（南洋理工大学）；Institute of Software, Chinese Academy of Sciences（中国科学院软件研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Beijing Forestry University（北京林业大学）；Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所）

Yujia Zheng, Tianhao Li, Haotian Huang, Tianyu Zeng, Jingyu Lu, Chuangxin Chu, Yuekai Huang, Ziyou Jiang, Qian Xiong, Yuyao Ge, Mingyang Li

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

针对现有对抗攻击将提示视为整体而忽略组件差异的问题，提出PromptAnatomy框架解剖提示组件并用ComPerturb选择性扰动，结合PPL过滤，在多个数据集和LLMs上实现最先进攻击成功率。

摘要：

基于提示的对抗攻击已成为评估大语言模型（LLMs）鲁棒性的有效手段。然而，现有方法通常将提示视为整体文本，忽略了其结构异质性——不同的提示组件对对抗鲁棒性的贡献并不相等。先前的工作如PromptRobust假设提示是价值中立的，但我们的分析揭示，具有丰富结构的复杂、领域特定提示，其组件具有不同的脆弱性。为解决这一差距，我们引入了PromptAnatomy，一个自动化框架，将提示解剖为功能组件，并通过使用我们提出的方法ComPerturb选择性扰动每个组件，生成多样化、可解释的对抗样本。为确保语言合理性和缓解分布偏移，我们进一步结合了基于困惑度（PPL）的过滤机制。作为补充资源，我们使用PromptAnatomy框架对四个公开的指令调优数据集进行了标注，并通过人工审查验证。跨这些数据集和五个先进LLMs的大量实验表明，ComPerturb实现了最先进的攻击成功率。消融研究验证了提示解剖和PPL过滤的互补益处。我们的结果强调了提示结构意识和受控扰动对于LLMs可靠对抗鲁棒性评估的重要性。代码和数据可在https://github.com/Yujiaaaaa/PACP获取。

英文摘要：

Prompt-based adversarial attacks have become an effective means to assess the robustness of large language models (LLMs). However, existing approaches often treat prompts as monolithic text, overlooking their structural heterogeneity-different prompt components contribute unequally to adversarial robustness. Prior works like PromptRobust assume prompts are value-neutral, but our analysis reveals that complex, domain-specific prompts with rich structures have components with differing vulnerabilities. To address this gap, we introduce PromptAnatomy, an automated framework that dissects prompts into functional components and generates diverse, interpretable adversarial examples by selectively perturbing each component using our proposed method, ComPerturb. To ensure linguistic plausibility and mitigate distribution shifts, we further incorporate a perplexity (PPL)-based filtering mechanism. As a complementary resource, we annotate four public instruction-tuning datasets using the PromptAnatomy framework, verified through human review. Extensive experiments across these datasets and five advanced LLMs demonstrate that ComPerturb achieves state-of-the-art attack success rates. Ablation studies validate the complementary benefits of prompt dissection and PPL filtering. Our results underscore the importance of prompt structure awareness and controlled perturbation for reliable adversarial robustness evaluation in LLMs. Code and data are available at https://github.com/Yujiaaaaa/PACP.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。