对LLM系统中安全控制的回报进行量化
Quantifying Return on Security Controls in LLM Systems
AI总结：
本文提出了一种量化LLM系统安全控制回报的方法，通过模拟攻击和风险评估，比较了ABAC、NER删除和NeMo Guardrails三种安全措施的效果，发现ABAC显著降低风险，RoC达到9.83。
摘要：
尽管大型语言模型（LLMs）越来越多地用于安全关键型工作流程，但从业者缺乏关于哪些安全措施值得部署的定量指导。本文介绍了一个面向决策的框架和可重复的方法论，两者共同量化残余风险，将对抗性探测结果转换为财务风险估计和回报率（RoC）指标，并使LLM系统中多层防御的货币比较成为可能。通过DeepSeek-R1模型在包含合成个人可识别信息（PII）的语料库上实例化一个检索增强生成（RAG）服务，并在五个漏洞类别上进行自动化攻击：PII泄露、潜在上下文注入、提示注入、对抗性攻击生成和分歧。对于每个（漏洞，控制）对，攻击成功率通过拉普拉斯成功法则估计，并与从公共泄露成本数据校准的损失三角分布结合，在10,000次运行的蒙特卡洛模拟中生成损失超越曲线和预期损失。然后比较三种广泛使用的缓解措施：基于属性的访问控制（ABAC）；使用微软Presidio的命名实体识别（NER）删除；以及NeMo Guardrails，与基线RAG配置。基线系统表现出非常高的攻击成功率（PII、潜在注入和提示注入均≥0.98），导致每个攻击场景的总模拟预期损失为31.3万美元。ABAC将PII和提示相关攻击的成功概率降低到接近零，将总预期损失减少约94%，实现RoC为9.83。NER删除同样消除PII泄露，实现RoC为5.97，而NeMo Guardrails仅提供微小益处（RoC为0.05）。
英文摘要：
Although large language models (LLMs) are increasingly used in security-critical workflows, practitioners lack quantitative guidance on which safeguards are worth deploying. This paper introduces a decision-oriented framework and reproducible methodology that together quantify residual risk, convert adversarial probe outcomes into financial risk estimates and return-on-control (RoC) metrics, and enable monetary comparison of layered defenses for LLM-based systems. A retrieval-augmented generation (RAG) service is instantiated using the DeepSeek-R1 model over a corpus containing synthetic personally identifiable information (PII), and subjected to automated attacks with Garak across five vulnerability classes: PII leakage, latent context injection, prompt injection, adversarial attack generation, and divergence. For each (vulnerability, control) pair, attack success probabilities are estimated via Laplace's Rule of Succession and combined with loss triangle distributions, calibrated from public breach-cost data, in 10,000-run Monte Carlo simulations to produce loss exceedance curves and expected losses. Three widely used mitigations, attribute-based access control (ABAC); named entity recognition (NER) redaction using Microsoft Presidio; and NeMo Guardrails, are then compared to a baseline RAG configuration. The baseline system exhibits very high attack success rates (>= 0.98 for PII, latent injection, and prompt injection), yielding a total simulated expected loss of $313k per attack scenario. ABAC collapses success probabilities for PII and prompt-related attacks to near zero and reduces the total expected loss by ~94%, achieving an RoC of 9.83. NER redaction likewise eliminates PII leakage and attains an RoC of 5.97, while NeMo Guardrails provides only marginal benefit (RoC of 0.05).
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
