TraceGuard: 用于对抗大语言模型推理后门的过程引导防火墙
TraceGuard: Process-Guided Firewall against Reasoning Backdoors in Large Language Models
AI总结：
TraceGuard通过过程引导框架提升大语言模型的推理安全性，有效对抗推理后门。
摘要：
大语言模型（LRMs）在高风险决策流程中的部署引入了一个新颖且不透明的攻击面：推理后门。在这些攻击中，模型的中间思维链（CoT）被操控以提供在语言上合理但逻辑上错误的结论解释。尽管前沿模型固有地能够检测这些裂痕，但紧凑、可部署的模型却面临根本的验证缺口，依赖于脆弱的词汇启发式方法，容易被有动机的对手绕过。为弥合这一缺口，我们提出了TraceGuard，一种过程引导的安全框架，将小型模型转变为稳健的推理防火墙。我们的方法将推理轨迹视为不可信的负载，并通过三个协同阶段建立纵深防御策略：（1）自动取证合成，生成对比性推理对以隔离特定的逻辑裂痕点；（2）步骤感知的监督微调（SSFT），以植入结构验证语法；以及（3）验证者引导的强化学习（VGRL），利用组相对策略优化。我们识别并缓解了基线对齐中的关键故障模式——词汇过拟合，即验证者记忆了对抗性触发器而不是审计逻辑完整性。我们的实证评估表明，TraceGuard作为一种安全增强因素：一个400亿参数的验证器在未见过的攻击上实现了取证精度，其效果可与两阶量级更大的架构相媲美。我们进一步展示了在灰盒环境下对适应性对手的鲁棒性，确立TraceGuard作为一种可行、低延迟的安全原始构件，用于可信计算基础。
英文摘要：
Large Reasoning Models (LRMs) introduce a reasoning-level attack surface: adversaries can corrupt intermediate inferences while preserving a plausible trace and an apparently benign output. Existing output guardrails cannot reliably identify where such a trace first becomes unsupported. We present TraceGuard, a compact, locally deployable reasoning firewall that treats model-generated reasoning as untrusted input. Its design combines grounded generation of verifiable audit traces, Step-Aware Supervised Fine-Tuning (SSFT) for process-level supervision, and Verifier-Guided Reinforcement Learning (VGRL) for hardening against difficult reasoning traces. TraceGuard audits intermediate steps, localizes the initial Point of Fracture, and grounds its final decision in the complete audit evidence. We evaluate TraceGuard across heterogeneous open-weight architectures, reasoning domains, and reasoning-integrity attack families. A compact Qwen3-4B-Guard substantially outperforms an unaligned 20B model under strict end-to-end detection. Its auditing behavior transfers to attack families excluded from training, resists in-scope black-box probing, and remains robust in an additional white-box stress test. Overall, 210,456 step-level audit decisions support compact, process-aligned verification as an effective, deployable defense boundary for reasoning systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
