无状态却非遗忘：隐式记忆作为LLM中的隐藏通道
Stateless Yet Not Forgetful: Implicit Memory as a Hidden Channel in LLMs
AI总结：
研究提出隐式记忆机制，使LLM在无显式存储的情况下通过输出编码信息实现跨交互状态传递，展示其在时间炸弹等安全问题中的应用及影响。
摘要：
大型语言模型（LLMs）通常被视为无状态：一旦交互结束，假设没有信息持续存在，除非显式存储并重新提供。我们通过引入隐式记忆来挑战这一假设，即模型能够通过在其自身输出中编码信息，并在这些输出重新引入为输入时恢复信息，从而在看似独立的交互之间携带状态。这种机制不需要任何显式记忆模块，却在推理请求之间创建了一个持久的信息通道。作为具体演示，我们引入了一种新的时间后门类，称为时间炸弹。与传统后门不同，时间炸弹只有在一系列交互满足通过隐式记忆积累的隐藏条件后才会激活。我们展示，这种行为可以通过简单的提示或微调来今天诱导。除了这一案例研究，我们分析了隐式记忆的更广泛影响，包括隐蔽的跨代理通信、基准污染、定向操纵和训练数据污染。最后，我们讨论了检测挑战，并概述了压力测试和评估的方向，目标是预见和控制未来的发展。为了促进未来研究，我们发布代码和数据：https://github.com/microsoft/implicitMemory。
英文摘要：
Large language models (LLMs) are commonly treated as stateless: once an interaction ends, no information is assumed to persist unless it is explicitly stored and re-supplied. We challenge this assumption by introducing implicit memory-the ability of a model to carry state across otherwise independent interactions by encoding information in its own outputs and later recovering it when those outputs are reintroduced as input. This mechanism does not require any explicit memory module, yet it creates a persistent information channel across inference requests. As a concrete demonstration, we introduce a new class of temporal backdoors, which we call time bombs. Unlike conventional backdoors that activate on a single trigger input, time bombs activate only after a sequence of interactions satisfies hidden conditions accumulated via implicit memory. We show that such behavior can be induced today through straightforward prompting or fine-tuning. Beyond this case study, we analyze broader implications of implicit memory, including covert inter-agent communication, benchmark contamination, targeted manipulation, and training-data poisoning. Finally, we discuss detection challenges and outline directions for stress-testing and evaluation, with the goal of anticipating and controlling future developments. To promote future research, we release code and data at: https://github.com/microsoft/implicitMemory.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
