攻击者可利用专家路由漏洞，用少量查询完全窃取用户输入的完整提示。
Stealing User Prompts from Mixture of Experts
- 通过批量共存查询触发专家选择路由漏洞
- 平均每个词仅需100次查询即可提取完整提示
- 首次揭示大模型架构缺陷导致的提示泄露风险
混合专家（MoE）模型通过将每个标记路由到每层少数专家来提升密集语言模型的效率与可扩展性。本文展示，攻击者若能使其查询与受害者查询同批处理，便可利用专家选择路由机制完全暴露受害者的提示内容。我们在两层Mixtral模型上成功验证了该攻击，利用torch.topk CUDA实现中的并列处理行为。结果表明，在我们设定的场景下，仅需约$O({VM}^2)$次查询（词汇量$V$，提示长度$M$），或平均每个词100次查询即可完整提取提示。这是首个针对大模型架构缺陷进行提示窃取的攻击，揭示了一类全新的大模型安全漏洞。
原文摘要 · Abstract (English)
Mixture-of-Experts (MoE) models improve the efficiency and scalability of dense language models by routing each token to a small number of experts in each layer. In this paper, we show how an adversary that can arrange for their queries to appear in the same batch of examples as a victim's queries can exploit Expert-Choice-Routing to fully disclose a victim's prompt. We successfully demonstrate the effectiveness of this attack on a two-layer Mixtral model, exploiting the tie-handling behavior of the torch.topk CUDA implementation. Our results show that we can extract the entire prompt using $O({VM}^2)$ queries (with vocabulary size $V$ and prompt length $M$) or 100 queries on average per token in the setting we consider. This is the first attack to exploit architectural flaws for the purpose of extracting user prompts, introducing a new class of LLM vulnerabilities.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。