DualSentinel: 一种用于通过双熵低谷模式检测黑盒LLM中针对性攻击的轻量级框架
DualSentinel: A Lightweight Framework for Detecting Targeted Attacks in Black-box LLM via Dual Entropy Lull Pattern
AI总结：
DualSentinel通过双熵低谷模式检测黑盒LLM中的针对性攻击，提供高效且准确的防御方案。
摘要：
近期智能系统通过API整合强大的大型语言模型（LLM），但其可信度可能因如后门和提示注入攻击等针对性攻击而受到严重破坏，这些攻击会秘密地迫使LLM生成特定的恶意序列。现有的防御方法通常依赖于高权限访问，施加了高昂的成本，并阻碍了正常的推理，使其在现实场景中不切实际。为了解决这些限制，我们引入了DualSentinel，一种轻量级且统一的防御框架，能够在LLM生成过程中准确且及时地检测到针对性攻击的激活。我们首先识别出被篡改的LLM的一个特征，称为熵低谷：当针对性攻击成功劫持生成过程时，LLM会表现出异常低且稳定的token概率熵的时期，表明它在遵循固定路径而不是进行创造性选择。DualSentinel通过开发一种创新的双检查方法利用这一模式。它首先采用一种幅度和趋势感知的监控方法，在运行时主动且敏感地标记熵低谷模式。在标记后，它会触发一种基于任务翻转的轻量但强大的二次验证。只有当熵低谷模式在原始任务和翻转任务中都持续存在时，才能确认攻击，证明LLM的输出是被强制控制的。广泛的评估显示，DualSentinel在检测准确性和效率方面都表现优异（高检测准确率，接近零的误报率）且非常高效（额外成本极低），为保护部署的LLM提供了一条真正可行的路径。源代码可通过https://doi.org/10.5281/zenodo.18479273访问。
英文摘要：
Recent intelligent systems integrate powerful Large Language Models (LLMs) through APIs, but their trustworthiness may be critically undermined by targeted attacks like backdoor and prompt injection attacks, which secretly force LLMs to generate specific malicious sequences. Existing defensive approaches for such threats typically rely on high access rights, impose prohibitive costs, and hinder normal inference, rendering them impractical for real-world scenarios. To solve these limitations, we introduce DualSentinel, a lightweight and unified defense framework that can accurately and promptly detect the activation of targeted attacks alongside the LLM generation process. We first identify a characteristic of compromised LLMs, termed Entropy Lull: when a targeted attack successfully hijacks the generation process, the LLM exhibits a distinct period of abnormally low and stable token probability entropy, indicating it is following a fixed path rather than making creative choices. DualSentinel leverages this pattern by developing an innovative dual-check approach. It first employs a magnitude and trend-aware monitoring method to proactively and sensitively flag an entropy lull pattern at runtime. Upon such flagging, it triggers a lightweight yet powerful secondary verification based on task-flipping. An attack is confirmed only if the entropy lull pattern persists across both the original and the flipped task, proving that the LLM's output is coercively controlled. Extensive evaluations show that DualSentinel is both highly effective (superior detection accuracy with near-zero false positives) and remarkably efficient (negligible additional cost), offering a truly practical path toward securing deployed LLMs. The source code can be accessed at https://doi.org/10.5281/zenodo.18479273.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
