提出新型攻击方法，突破大模型安全防护管道
STACK: Adversarial Attacks on LLM Safeguard Pipelines
- 设计少样本提示分类器，优于现有开源防护模型
- 提出分阶段攻击策略，黑盒攻击成功率达71%
- 攻击可跨模型迁移，为开发者提供防御参考
前沿AI开发者正依赖多层防护管道防止人工智能系统被灾难性滥用。Anthropic和OpenAI使用此类防御机制保护其最新版Opus 4与GPT-5模型，Google DeepMind也承诺即将部署类似措施。然而，这些管道的安全性尚不明确，此前缺乏对它们的有效评估或攻击研究。本文通过构建并红队测试一个开源防御管道来填补这一空白。首先，我们发现一种新的少样本提示输入输出分类器，在三种攻击和两个数据集上表现优于当前最优的开源防护模型ShieldGemma，将灾难性滥用数据集ClearHarm上的攻击成功率（ASR）降至0%。其次，我们提出一种分阶段攻击（STACK）流程，在针对该分类器管道的黑盒攻击中实现71%的ASR。最后，我们在迁移设置下评估STACK，达到33%的攻击成功率，初步证明无需访问目标管道即可设计有效攻击。文章最后建议具体缓解措施，帮助开发者应对分阶段攻击。
原文摘要 · Abstract (English)
Frontier AI developers are relying on layers of safeguards to protect against catastrophic misuse of AI systems. Anthropic and OpenAI guard their latest Opus 4 model and GPT-5 models using such defense pipelines, and other frontier developers including Google DeepMind pledge to soon deploy similar defenses. However, the security of such pipelines is unclear, with limited prior work evaluating or attacking these pipelines. We address this gap by developing and red-teaming an open-source defense pipeline. First, we find that a novel few-shot-prompted input and output classifier outperforms state-of-the-art open-weight safeguard model ShieldGemma across three attacks and two datasets, reducing the attack success rate (ASR) to 0% on the catastrophic misuse dataset ClearHarm. Second, we introduce a STaged AttaCK (STACK) procedure that achieves 71% ASR on ClearHarm in a black-box attack against the few-shot-prompted classifier pipeline. Finally, we also evaluate STACK in a transfer setting, achieving 33% ASR, providing initial evidence that it is feasible to design attacks with no access to the target pipeline. We conclude by suggesting specific mitigations that developers could use to thwart staged attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。