用智能体自身检测并防御后门攻击，有效提升安全可靠性
Your Agent Can Defend Itself against Backdoor Attacks
- 通过分析指令、规划与执行的一致性识别后门
- 在数据库操作中将攻击成功率降低90%以上
- 适合关注大模型智能体安全的研究者和开发者
尽管大型语言模型（LLM）驱动的智能体在各领域广泛应用，但在训练和微调过程中面临严重的后门攻击风险。这些被攻陷的智能体在遇到特定触发条件时可能执行恶意操作。为应对这一威胁，我们提出 ReAgent，一种针对基于 LLM 智能体的多种后门攻击的新防御方法。直觉上，后门攻击常导致用户指令、智能体规划与执行之间的不一致。ReAgent 采用两级检测机制：在执行层面，验证智能体的思考与行为是否一致；在规划层面，利用智能体重建指令的能力，检查其思考轨迹重构的指令与原始指令是否一致。大量实验表明，ReAgent 在多项任务中均表现出色，例如在数据库操作任务中，将攻击成功率降低高达90%，显著优于现有防御方法。该工作揭示了利用受污染智能体本身来缓解后门风险的潜力。
原文摘要 · Abstract (English)
Despite their growing adoption across domains, large language model (LLM)-powered agents face significant security risks from backdoor attacks during training and fine-tuning. These compromised agents can subsequently be manipulated to execute malicious operations when presented with specific triggers in their inputs or environments. To address this pressing risk, we present ReAgent, a novel defense against a range of backdoor attacks on LLM-based agents. Intuitively, backdoor attacks often result in inconsistencies among the user's instruction, the agent's planning, and its execution. Drawing on this insight, ReAgent employs a two-level approach to detect potential backdoors. At the execution level, ReAgent verifies consistency between the agent's thoughts and actions; at the planning level, ReAgent leverages the agent's capability to reconstruct the instruction based on its thought trajectory, checking for consistency between the reconstructed instruction and the user's instruction. Extensive evaluation demonstrates ReAgent's effectiveness against various backdoor attacks across tasks. For instance, ReAgent reduces the attack success rate by up to 90\% in database operation tasks, outperforming existing defenses by large margins. This work reveals the potential of utilizing compromised agents themselves to mitigate backdoor risks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。