BadTemplate: 一种通过聊天模板进行的无训练后门攻击针对大语言模型
BadTemplate: A Training-Free Backdoor Attack via Chat Template Against Large Language Models
AI总结：
BadTemplate通过在系统提示中植入恶意指令实现无训练后门攻击，有效提升攻击成功率并引发严重安全风险。
摘要：
聊天模板是大型语言模型（LLMs）训练和推理阶段常用的技术。它可以将输入和输出数据转换为基于角色和模板的表达式，以提高LLMs的性能。然而，这也创造了一个新的攻击面。在本文中，我们首先揭示了聊天模板的可定制性允许攻击者控制模板以在系统提示中注入任意字符串而无需用户的注意。在此基础上，我们提出了一种无训练后门攻击，称为BadTemplate。具体而言，BadTemplate将精心设计的恶意指令插入到高优先级的系统提示中，从而导致目标LLM表现出持久的后门行为。BadTemplate通过将恶意指令直接嵌入到系统提示中，消除了模型再训练的需要，同时以最小的成本实现了高效的攻击效果。此外，其简单性和可扩展性使其在现实系统中易于广泛部署，从而引发严重风险，包括快速传播、经济损失和大规模虚假信息。此外，主要第三方平台HuggingFace和LLM-as-a-judge的检测证明对BadTemplate效果不大。在5个基准数据集上对6个开源和3个闭源LLM进行的广泛实验，与3个基线相比，证明BadTemplate实现了高达100%的攻击成功率，并在词级和句子级攻击中显著优于传统的提示基于后门。我们的工作突显了聊天模板在LLM供应链中可能带来的安全风险，从而支持了有效防御机制的发展。
英文摘要：
Chat template is a common technique used in the training and inference stages of Large Language Models (LLMs). It can transform input and output data into role-based and templated expressions to enhance the performance of LLMs. However, this also creates a breeding ground for novel attack surfaces. In this paper, we first reveal that the customizability of chat templates allows an attacker who controls the template to inject arbitrary strings into the system prompt without the user's notice. Building on this, we propose a training-free backdoor attack, termed BadTemplate. Specifically, BadTemplate inserts carefully crafted malicious instructions into the high-priority system prompt, thereby causing the target LLM to exhibit persistent backdoor behaviors. BadTemplate outperforms traditional backdoor attacks by embedding malicious instructions directly into the system prompt, eliminating the need for model retraining while achieving high attack effectiveness with minimal cost. Furthermore, its simplicity and scalability make it easily and widely deployed in real-world systems, raising serious risks of rapid propagation, economic damage, and large-scale misinformation. Furthermore, detection by major third-party platforms HuggingFace and LLM-as-a-judge proves largely ineffective against BadTemplate. Extensive experiments conducted on 5 benchmark datasets across 6 open-source and 3 closed-source LLMs, compared with 3 baselines, demonstrate that BadTemplate achieves up to a 100% attack success rate and significantly outperforms traditional prompt-based backdoors in both word-level and sentence-level attacks. Our work highlights the potential security risks raised by chat templates in the LLM supply chain, thereby supporting the development of effective defense mechanisms.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
