批量提示存在安全漏洞，攻击者可诱导模型生成有害内容。
Efficient but Vulnerable: Benchmarking and Defending LLM Batch Prompting Attack
- 构建150种攻击指令的基准测试集，验证批量提示漏洞
- 所有主流大模型均受攻击影响，攻击成功率高
- 基于探测的防御方法准确率达95%，适合实际部署
批量提示通过合并多个共享上下文的查询来降低推理成本，但我们的研究揭示了其显著的安全漏洞：恶意用户可在批量中注入攻击指令，导致所有查询被干扰，可能引发有害内容（如钓鱼链接）或逻辑推理失效。本文构建了BATCHSAFEBENCH基准，包含150种攻击指令和8,000个批量实例，系统评估该漏洞。对闭源与开源大模型的测试表明，所有模型均易受攻击。我们进一步探索多种防御方法，提示类防御在小型模型上效果有限，而探测类方法可实现约95%的攻击检测准确率。此外，通过机制分析识别出与攻击相关的注意力头。
原文摘要 · Abstract (English)
Batch prompting, which combines a batch of multiple queries sharing the same context in one inference, has emerged as a promising solution to reduce inference costs. However, our study reveals a significant security vulnerability in batch prompting: malicious users can inject attack instructions into a batch, leading to unwanted interference across all queries, which can result in the inclusion of harmful content, such as phishing links, or the disruption of logical reasoning. In this paper, we construct BATCHSAFEBENCH, a comprehensive benchmark comprising 150 attack instructions of two types and 8k batch instances, to study the batch prompting vulnerability systematically. Our evaluation of both closed-source and open-weight LLMs demonstrates that all LLMs are susceptible to batch-prompting attacks. We then explore multiple defending approaches. While the prompting-based defense shows limited effectiveness for smaller LLMs, the probing-based approach achieves about 95% accuracy in detecting attacks. Additionally, we perform a mechanistic analysis to understand the attack and identify attention heads that are responsible for it.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。