STAR: 通过状态转移放大比率检测推理时后门
STAR: Detecting Inference-time Backdoors in LLM Reasoning via State-Transition Amplification Ratio
AI总结：
STAR通过分析输出概率变化检测推理时后门，利用状态转移放大比率和CUSUM算法实现高效率和高准确率的后门检测。
摘要：
最近的大型语言模型越来越多地集成了像链式思维（CoT）这样的推理机制。然而，这种显式的推理暴露了新的攻击面，即推理时后门，它们在不改变模型参数的情况下注入恶意推理路径。因为这些攻击生成的语言上连贯的路径，因此能够有效逃避传统的检测。为了解决这个问题，我们提出了STAR（状态转移放大比率），一个通过分析输出概率变化来检测后门的框架。STAR利用统计差异，其中恶意输入引起的路径在模型通用知识中具有高后验概率，尽管先验概率较低。我们量化了这种状态转移放大，并利用CUSUM算法来检测持续异常。在多样化的模型（8B-70B）和五个基准数据集上的实验表明，STAR表现出强大的泛化能力，一致地实现接近完美的性能（AUROC≈1.0），效率比现有基线高约42倍。此外，该框架对试图绕过检测的自适应攻击证明了鲁棒性。
英文摘要：
Recent LLMs increasingly integrate reasoning mechanisms like Chain-of-Thought (CoT). However, this explicit reasoning exposes a new attack surface for inference-time backdoors, which inject malicious reasoning paths without altering model parameters. Because these attacks generate linguistically coherent paths, they effectively evade conventional detection. To address this, we propose STAR (State-Transition Amplification Ratio), a framework that detects backdoors by analyzing output probability shifts. STAR exploits the statistical discrepancy where a malicious input-induced path exhibits high posterior probability despite a low prior probability in the model's general knowledge. We quantify this state-transition amplification and employ the CUSUM algorithm to detect persistent anomalies. Experiments across diverse models (8B-70B) and five benchmark datasets demonstrate that STAR exhibits robust generalization capabilities, consistently achieving near-perfect performance (AUROC $\approx$ 1.0) with approximately $42\times$ greater efficiency than existing baselines. Furthermore, the framework proves robust against adaptive attacks attempting to bypass detection.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
