SpecCloak：通过工程规范探测有害代码生成
SpecCloak: Probing Harmful Code Generation through Engineering Specifications
AI总结：
本研究针对LLM恶意代码生成的弃权问题，提出结合PseudoSpec与判别器引导优化的黑盒红队框架SpecCloak，在RedCode-Gen上实现28.91%平均攻击成功率，同时推出无需微调的防御原型SpecReveal，达96.88%攻击检测率。
摘要：
大型语言模型（LLM）的代码生成能力同样可能被滥用以实现有害功能，这凸显了理解其对编程请求的安全行为的必要性。虽然已知请求措辞会影响模型的弃权（不执行）行为，但目前尚不清楚编码任务要求的表述形式是否会影响恶意代码生成的弃权过程。我们引入PseudoSpec，一种将功能需求组织为工程规范的模板，并通过受控对比、表示分析和激活干预来研究其效果。在五个开放权重模型中，移除明确的风险关键词仅能部分减少弃权，而即使保留这些关键词，规范提示也会大幅降低弃权率。这种降低伴随着向代码输出相关表示的一致转变，且沿条件差异方向的干预会改变弃权行为。输出分析进一步区分了代码相关响应与生成退化。基于这些发现，我们提出SpecCloak，一种结合PseudoSpec与判别器引导优化的黑盒红队框架，在RedCode-Gen数据集上对八个目标模型实现了28.91%的平均执行验证攻击成功率。我们还引入SpecReveal，一种结合自然语言意图重构与双视图检测的防御原型，无需对目标模型进行微调，在单独的提示检测评估中实现了96.88%的攻击检测率，同时对良性编程和规范风格输入评估了误报情况。这些结果将规范诱导的响应差异与实际安全后果联系起来，并确定意图重构是一种互补的检测方法。
英文摘要：
The code generation capabilities of large language models (LLMs) can equally be misused to implement harmful functionality, underscoring the need to understand their safety behavior in response to programming requests. While request phrasing is known to influence refusal, it remains unclear whether the form in which coding task requirements are stated affects the refusal process for malicious code generation. We introduce PseudoSpec, a template that organizes functional requirements as engineering specifications, and investigate its effects through controlled comparisons, representation analysis, and activation interventions. Across five open-weight models, removing explicit risk keywords only partially reduces refusal, whereas specification prompting substantially lowers refusal even when these keywords are retained. This reduction accompanies consistent shifts toward code-output-related representations, and interventions along condition-difference directions alter refusal behavior. Output analysis further distinguishes code-related responses from generation degeneration. Building on these findings, we propose SpecCloak, a black-box red-teaming framework combining PseudoSpec with discriminator-guided optimization, achieving an average execution-verified attack success rate of 28.91\% across eight target models on RedCode-Gen. We also introduce SpecReveal, a defense prototype combining natural-language intent reconstruction with dual-view detection without target-model fine-tuning. It achieves a 96.88\% attack detection rate in a separate prompt-detection evaluation, with false positives assessed on benign programming and specification-style inputs. These results connect specification-induced response differences to practical security consequences and identify intent reconstruction as a complementary detection approach.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
