用多语言段落构造隐蔽后门，让大模型无感中招
CL-Attack: Textual Backdoor Attacks via Cross-Lingual Triggers
- 用跨语言结构文本做触发器，提升隐蔽性与通用性
- 在分类和生成任务中攻击成功率接近100%，毒化率低
- 对现有防御手段更鲁棒，适合研究模型安全的读者
后门攻击严重威胁大语言模型的安全性，通过特定触发条件诱导模型输出预设内容。现有文本后门触发方式分为固定词元和句式模式两类：前者易被检测过滤，后者如语法风格不适用于所有样本且可能引发语义偏移。本文受真实场景中大模型跨语言提示的启发，提出一种更高维度的段落级触发方法——CL-Attack。该方法通过引入包含多种语言结构的文本注入后门，在分类与生成任务中均实现近100%攻击成功率，且毒化率极低。实验表明，相比基线攻击，CL-Attack对当前主流防御方法更具鲁棒性。为进一步缓解该威胁，我们提出新防御机制TranslateDefense，可部分抵消其影响。
原文摘要 · Abstract (English)
Backdoor attacks significantly compromise the security of large language models by triggering them to output specific and controlled content. Currently, triggers for textual backdoor attacks fall into two categories: fixed-token triggers and sentence-pattern triggers. However, the former are typically easy to identify and filter, while the latter, such as syntax and style, do not apply to all original samples and may lead to semantic shifts. In this paper, inspired by cross-lingual (CL) prompts of LLMs in real-world scenarios, we propose a higher-dimensional trigger method at the paragraph level, namely CL-attack. CL-attack injects the backdoor by using texts with specific structures that incorporate multiple languages, thereby offering greater stealthiness and universality compared to existing backdoor attack techniques. Extensive experiments on different tasks and model architectures demonstrate that CL-attack can achieve nearly 100% attack success rate with a low poisoning rate in both classification and generation tasks. We also empirically show that the CL-attack is more robust against current major defense methods compared to baseline backdoor attacks. Additionally, to mitigate CL-attack, we further develop a new defense called TranslateDefense, which can partially mitigate the impact of CL-attack.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。