SilentCall：开源权重智能体中的隐藏工具调用后门及其检测方法
SilentCall: Hidden Tool-Call Backdoors in Open-Weight Agents, and How to Catch Them
浏览论文内容
中文总结 AI 辅助
SilentCall揭示开源权重工具调用智能体可隐藏后门攻击，通过日期触发窃取凭据，并提出了运行时监控、高温探测和权重审计三种检测方法，强调运行时检查与安全审计的重要性。
中文摘要 AI 辅助
开源权重工具调用智能体因其优异表现（通常以基准测试分数和可靠使用记录衡量）而被采用。我们证明，模型发布者可以训练一个既获得这些优势又隐藏恶意行为的智能体。通过混合干净与投毒对话进行微调，我们的智能体能正确回答普通请求；一旦系统日期达到选定年份，它们会发出正确的工具调用，并同时发出一个窃取用户凭据的调用。窃取行为在用户可见响应仅提及合法工作时运行。我们将此攻击称为SilentCall。在触发条件下，它在至少99.6%的请求中触发，且没有任何响应提及它。该攻击可通过三种不同方法检测，主要区别在于防御者运行它们所需的条件。在每次工具调用执行前检查它的运行时监控器无需访问模型，能以1.73%的误报率捕获我们测试的每个载荷实例。高温探测仅需已发布的权重。权重分布审计需要用嫌疑人的配方训练良性模型，这使其在模型中心可及，但对普通用户不可及。相比之下，对齐基准无法区分投毒模型与良性模型。SilentCall在标准基准上不留痕迹。随着工具使用智能体在开源权重供应链中传播，对它们的信任不应基于模型对其自身行为的描述。信任必须来自在运行时检查这些行为、在模型分发处审计模型，并将工具访问视为独立的安全表面。
英文摘要
Open-weight tool-calling agents are adopted on evidence of merit, usually benchmark scores and a record of reliable use. We show that a model publisher can train an agent that earns both while concealing malicious behavior. Fine-tuned on a mixture of clean and poisoned conversations, our agents answer ordinary requests correctly; once the system date reaches a chosen year, they emit the correct tool call and, alongside it, one that exfiltrates the user's credentials. The exfiltration runs while the user-facing response mentions only the legitimate work. We call this attack SilentCall. Under the trigger, it fires on at least $99.6$\% of requests, and no response ever mentions it. The attack is detectable by three distinct methods, which differ mainly in what a defender needs to run them. A runtime monitor that inspects each tool call before it executes requires no access to the model and catches every instance of the payload we tested at a 1.73% false-positive rate. High-temperature probing requires only the published weights. The weight-distribution audit requires training a benign model with the suspect's recipe, placing it within reach of model hubs but not ordinary users. Alignment benchmarks, by contrast, do not separate poisoned from benign models. SilentCall leaves no trace on standard benchmarks. As tool-using agents spread through the open-weight supply chain, trust in them should not rest on what a model says about its own actions. It has to come from inspecting those actions at runtime, auditing models where they are distributed, and treating tool access as a security surface in its own right.
发表机构
- Armada（Armada公司）
机构由 AI 辅助整理，请以论文原文为准。
