仅用目标文本生成攻击，无需模型访问就能高效欺骗大语言模型。
No Query, No Access
- 仅依赖目标文本构建替代模型，避免直接调用模型接口。
- 在情感分类数据集上实现45.99%攻击成功率，查询次数降至0。
- 对Qwen2、GPT等模型构成真实威胁，适合安全评估与防御研究者参考。
文本对抗攻击通过细微修改文本误导NLP模型，包括大型语言模型（LLMs）。现有方法通常需了解目标模型、大量查询或训练数据，限制了实际可行性。为此，我们提出基于目标文本的对抗攻击（VDBA），仅使用目标文本即可实施攻击。为避免访问目标模型，我们利用公开预训练模型与聚类方法构建影子数据集，用于训练替代模型。针对单一替代模型在决策边界失效导致攻击成功率低的问题，提出分层替代模型设计。同时采用多种对抗样本生成策略，综合选择相似度高且攻击效果好的样本。在Emotion和SST5数据集上的实验表明，VDBA显著优于现有方法，攻击成功率（ASR）提升52.08%，查询次数减少至0。更重要的是，VDBA对Qwen2和GPT系列模型构成严重威胁，即使无API访问仍达到最高45.99%的攻击成功率，证实先进NLP模型仍存在重大安全风险。
原文摘要 · Abstract (English)
Textual adversarial attacks mislead NLP models, including Large Language Models (LLMs), by subtly modifying text. While effective, existing attacks often require knowledge of the victim model, extensive queries, or access to training data, limiting real-world feasibility. To overcome these constraints, we introduce the \textbf{Victim Data-based Adversarial Attack (VDBA)}, which operates using only victim texts. To prevent access to the victim model, we create a shadow dataset with publicly available pre-trained models and clustering methods as a foundation for developing substitute models. To address the low attack success rate (ASR) due to insufficient information feedback, we propose the hierarchical substitution model design, generating substitute models to mitigate the failure of a single substitute model at the decision boundary. Concurrently, we use diverse adversarial example generation, employing various attack methods to generate and select the adversarial example with better similarity and attack effectiveness. Experiments on the Emotion and SST5 datasets show that VDBA outperforms state-of-the-art methods, achieving an ASR improvement of 52.08\% while significantly reducing attack queries to 0. More importantly, we discover that VDBA poses a significant threat to LLMs such as Qwen2 and the GPT family, and achieves the highest ASR of 45.99% even without access to the API, confirming that advanced NLP models still face serious security risks. Our codes can be found at https://anonymous.4open.science/r/VDBA-Victim-Data-based-Adversarial-Attack-36EC/
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。