状态空间模型中的安全性、安全性和认知风险：基于谱、状态ful和容量攻击的系统性威胁分析
Safety, Security, and Cognitive Risks in State-Space Models: A Systematic Threat Analysis with Spectral, Stateful, and Capacity Attacks
AI总结：
本文系统分析了状态空间模型的安全性、安全性和认知风险，提出了七项贡献，包括威胁框架、三种新型攻击类别、14项MITRE ATLAS技术扩展以及针对不同领域的攻击者分类。
摘要：
状态空间模型（SSMs）--结构化的SSMs（S4、S4D、DSS、S5）、选择性的SSMs（Mamba、Mamba-2）和混合架构（Jamba）--被应用于安全关键的长上下文应用：基因组分析、临床时间序列预测和网络安全日志处理。其线性时间扩展性具有吸引力，但其压缩状态递归架构的安全属性尚无研究。本文首次系统地探讨了SSMs的安全性、安全性和认知风险。七项贡献：（1）正式威胁框架--SSM攻击面（五层）、状态完整性违反（StIV）、跨上下文放大比$\mathcal{X}_\mathcal{S}$，以及基于$H_\infty$范数的谱敏感性命题。（2）三种新型攻击类别：谱对抗攻击（转移函数增益利用）、延迟触发状态ful后门（注入后激活数千步）、状态容量饱和（熵洪水迫使沉默遗忘）。（3）14项MITRE ATLAS技术扩展贯穿完整战术链。（4）六种攻击者分类，包含基因组、临床和网络安全领域的杀戮链。（5）四项认知风险假说，基于状态压缩机制。（6）与治理对齐的缓解措施，映射到CREST、NIST AI 600-1和欧盟AI法案。（7）实证评估：定向基因组注入实现StIV=0.519 vs. 0.086随机（6.0×，p<0.001）；PGD状态注入实现输出扰动156×超过随机；SSD结构提取确认在O(N²) vs. O(N³)查询复杂度（N×速度提升）。在附录中详细说明了在预训练检查点上的验证。
英文摘要：
State-Space Models (SSMs) -- structured SSMs (S4, S4D, DSS, S5), selective SSMs (Mamba, Mamba-2), and hybrid architectures (Jamba) -- are deployed in safety-critical long-context applications: genomic analysis, clinical time-series forecasting, and cybersecurity log processing. Their linear-time scaling is compelling, yet the security properties of their compressed-state recurrent architectures remain unstudied. We present the first systematic treatment of SSM safety, security, and cognitive risks. Seven contributions: (1) Formal threat framework -- SSM Attack Surface (five layers), State Integrity Violation (StIV), Cross-Context Amplification Ratio $\mathcal{X}_\mathcal{S}$, and a Spectral Sensitivity Proposition grounded in the $H_\infty$ norm. (2) Three novel attack classes: spectral adversarial attacks (transfer-function gain exploitation), delayed-trigger stateful backdoors (activate thousands of steps after injection), and state capacity saturation (entropy flooding forces silent forgetting). (3) 14 MITRE ATLAS technique extensions across the full tactic chain. (4) Six-profile attacker taxonomy with kill chains for genomics, clinical, and cybersecurity domains. (5) Four cognitive risk hypotheses grounded in state-compression mechanics. (6) Governance-aligned mitigations mapped to CREST, NIST AI 600-1, and EU AI Act. (7) Empirical evaluation: targeted genomic injection achieves $\mathrm{StIV}=0.519$ vs. $0.086$ random ($6.0\times$, $p<0.001$); PGD state injection achieves $156\times$ output perturbation over random; SSD-structured extraction confirmed at $O(N^2)$ vs. $O(N^3)$ query complexity ($N\times$ speedup). Validation on pretrained checkpoints is detailed in the Appendix.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
