英语、泰米尔语与坦格利什语间的可见推理及间接提示注入可监控性
Visible Reasoning and Indirect Prompt-Injection Monitorability Across English, Tamil, and Tanglish
浏览论文内容
中文总结 AI 辅助
该研究针对Sarvam-105B，通过英语、泰米尔语、坦格利什语的案例研究，分析间接提示注入下可见推理的监控性，发现推理存在时攻击成功率变化，为可见推理的行为信息提供可复现案例。
中文摘要 AI 辅助
思维链监控是一种潜在有用的安全信号，但其在不同语言和行为场景中的可靠性仍不确定。在一项针对8个经人工验证的合成场景的小型案例研究中，采用1个模型、1个标注员和1个确定性生成种子，研究了Sarvam-105B在英语、泰米尔语和坦格利什语中发生间接提示注入时的API可见推理情况。一项包含4个场景的预实验发现，12次注入攻击中有5次在无推理时成功，11次中有1次在有推理时成功。一项预先注册的包含4个场景的后续研究反转了该方向，发现12次攻击中有2次在无推理时成功，12次中有3次在有推理时成功。由于每个阶段仅4个场景，该设计无法区分真实的推理模式效应与特定提示变异或采样噪声。在20条非空的注入思维轨迹中，所有17条良性正确输出均表明存在忽略注入的意图，而所有3次攻击成功均表明存在遵循注入的意图。这些描述性观察提供了一项关于可用时具有行为信息的可见推理的可复现案例研究；它们未证实推理模式可提升安全性、可见推理具有机制忠实性，或该发现可推广至此配置之外。
英文摘要
Chain-of-thought monitoring is a potentially useful safety signal, but its reliability across languages and behavioral settings remains uncertain. In a small case study of eight manually verified synthetic scenarios, one model, one annotator, and one deterministic generation seed, I study API-visible reasoning during indirect prompt injection in Sarvam-105B across English, Tamil, and Tanglish. A four scenario pilot found 5/12 injected attack successes without reasoning and 1/11 with reasoning. A preregistered four-scenario follow-up reversed that direction, finding 2/12 attacks without reasoning and 3/12 with reasoning. With only four scenarios per phase, this design cannot distinguish a real reasoning-mode effect from prompt-specific variation or sampling noise. Across 20 non-empty injected-thinking traces, all 17 benign-correct outputs stated an intent to ignore the injection, while all three attack successes stated an intent to follow it. These descriptive observations provide a reproducible case study of behaviorally informative visible reasoning when it is available; they do not establish that reasoning mode improves safety, that visible reasoning is mechanistically faithful, or that the findings generalize beyond this configuration.
发表机构
- Vellore Institute of Technology（韦洛尔理工大学）
机构由 AI 辅助整理，请以论文原文为准。
