测试大模型能否自动攻破对抗样本防御，发现真实场景远比竞赛题难。
AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defenses
- 用真实安全专家任务构建评测基准，评估LLM自主攻防能力。
- 强代理可攻破75%竞赛类防御，但仅13%真实防御，差距显著。
- 真实防御更复杂，适合对抗机器学习研究者参考。
我们提出AutoAdvExBench，一个用于评估大语言模型（LLMs）是否能自主攻破对抗样本防御的基准。与以往多作为现实任务代理的安全评测不同，该基准直接衡量LLM在机器学习安全专家日常执行任务中的表现。若LLM能在此基准上成功，即具备实际应用价值。我们设计了一个强智能体，可攻破75%的CTF类（类似作业题）防御。然而，在真实防御中成功率仅为13%，表明攻击真实代码的难度远超竞赛类代码。相比之下，一个能攻破21%真实防御的更强模型，仅在54%的竞赛类防御中成功。该基准已开源：https://github.com/ethz-spylab/AutoAdvExBench。
原文摘要 · Abstract (English)
We introduce AutoAdvExBench, a benchmark to evaluate if large language models (LLMs) can autonomously exploit defenses to adversarial examples. Unlike existing security benchmarks that often serve as proxies for real-world tasks, bench directly measures LLMs' success on tasks regularly performed by machine learning security experts. This approach offers a significant advantage: if a LLM could solve the challenges presented in bench, it would immediately present practical utility for adversarial machine learning researchers. We then design a strong agent that is capable of breaking 75% of CTF-like ("homework exercise") adversarial example defenses. However, we show that this agent is only able to succeed on 13% of the real-world defenses in our benchmark, indicating the large gap between difficulty in attacking "real" code, and CTF-like code. In contrast, a stronger LLM that can attack 21% of real defenses only succeeds on 54% of CTF-like defenses. We make this benchmark available at https://github.com/ethz-spylab/AutoAdvExBench.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。