推理引擎指纹攻击是切实可行的：探索模型驱动的环境发现、利用与逃逸

中文摘要 AI 辅助

前沿AI模型正迅速获得利用复杂软件中漏洞的能力。这种风险并非理论性的，OpenAI和Anthropic近期发生的前沿模型沙箱逃逸事件即为明证。关于如何对推理栈组件进行沙箱化的讨论，往往聚焦于推理引擎本身以外的组件（如网络代理或代码执行环境）。然而，推理引擎对于不对齐的模型而言是一个极具吸引力的目标。例如，如果模型仅通过生成特制的输出令牌就能触发该引擎中的漏洞利用，那么模型就可以在引擎中发起一条多步骤、直达裸机的漏洞利用链，而无需依赖推理栈中其他组件的漏洞，也无需借助外部提供的恶意构造输入令牌。在本文中，我们证明不对齐的模型可以执行推理引擎指纹识别，以确定执行该模型的具体引擎（如vLLM、SGLang）。一旦引擎被指纹识别，模型即可利用特定于引擎的漏洞，仅凭精心选择的输出令牌来控制该引擎。我们在五个流行的引擎中提供了模型指纹的具体示例，并演示了现实的智能体化测试平台如何允许模型利用这些指纹来识别本地引擎。我们还描述了一条概念验证的、从被指纹识别（并随后被攻陷）的推理引擎出发、直达裸机的漏洞利用链。最后，我们讨论了若干可以改变推理引擎以增加指纹攻击难度的方式。

英文摘要

Frontier AI models are rapidly gaining the ability to exploit vulnerabilities in complex pieces of software. The risk is not theoretical, as evidenced by recent sandbox escapes performed by frontier models at OpenAI and Anthropic. Discussions of how to sandbox inference stack components often focus on components other than the inference engine itself (e.g., network proxies or code execution environments). However, the inference engine is an attractive target for a misaligned model. For example, if a model can trigger exploits in that engine merely by generating specially-crafted output tokens, the model can initiate a multi-step, to-the-bare-metal exploit chain in the engine, without relying on vulnerabilities in other components of the inference stack, and without assistance from externally-provided, maliciously-crafted input tokens. In this paper, we show that a misaligned model can perform inference engine fingerprinting to determine the specific engine (e.g., vLLM, SGLang) which executes the model. Once the engine has been fingerprinted, the model can leverage engine-specific exploits to take control of the engine using only carefully-selected output tokens. We provide concrete examples of model fingerprints in five popular engines, and demonstrate how realistic agentic harnesses allow a model to leverage those fingerprints to identify the local engine. We also describe a proof-of-concept, to-the-bare-metal exploit chain that originates from a fingerprinted (and subsequently compromised) inference engine. We conclude by discussing several ways that inference engines could be changed to make fingerprinting attacks more difficult.

发表机构

• Harvard University（哈佛大学）

机构由 AI 辅助整理，请以论文原文为准。