为大模型代码解释器安全设计测试基准，发现多个主流模型存在严重漏洞。
Running in CIRCLE? A Simple Benchmark for LLM Code Interpreter Security
- 构建1260个针对资源耗尽的攻击提示，分直接和间接两类
- 部分模型拒绝恶意请求率不足1%，间接提示可绕过防御
- 适合关注AI安全、模型部署风险的研究者与工程师
随着大型语言模型（LLMs）越来越多地集成原生代码解释器，其具备了强大的实时执行能力，显著拓展了应用范围。然而，这种集成引入了与提示攻击不同的系统级网络安全威胁。为系统评估此类解释器特异性风险，我们提出了CIRCLE（代码解释器抗攻击能力检测基准），包含1,260个针对CPU、内存和磁盘资源耗尽的提示，每类风险均包含显式恶意（直接）和看似合理（间接）的提示变体。我们的自动化评估框架不仅判断模型是否拒绝或生成危险代码，还实际在解释器环境中执行生成代码，以评估代码正确性、模型为安全做出的简化，或执行超时。对来自OpenAI和Google的7个商用模型进行评估，发现显著且不一致的安全漏洞。例如，OpenAI的o4-mini在7.1%的情况下正确拒绝危险请求，远高于GPT-4.1的0.5%。结果特别表明，间接的社会工程类提示会大幅削弱模型防御能力。这凸显了建立解释器专用安全基准、专用防护工具（如护栏）和行业标准的迫切需求，以推动大模型解释器的负责任部署。该基准数据集和评估代码已公开发布，以促进后续研究。
原文摘要 · Abstract (English)
As large language models (LLMs) increasingly integrate native code interpreters, they enable powerful real-time execution capabilities, substantially expanding their utility. However, such integrations introduce potential system-level cybersecurity threats, fundamentally different from prompt-based vulnerabilities. To systematically evaluate these interpreter-specific risks, we propose CIRCLE (Code-Interpreter Resilience Check for LLM Exploits), a simple benchmark comprising 1,260 prompts targeting CPU, memory, and disk resource exhaustion. Each risk category includes explicitly malicious ("direct") and plausibly benign ("indirect") prompt variants. Our automated evaluation framework assesses not only whether LLMs refuse or generates risky code, but also executes the generated code within the interpreter environment to evaluate code correctness, simplifications made by the LLM to make the code safe, or execution timeouts. Evaluating 7 commercially available models from OpenAI and Google, we uncover significant and inconsistent vulnerabilities. For instance, evaluations show substantial disparities even within providers - OpenAI's o4-mini correctly refuses risky requests at 7.1%, notably higher rates compared to GPT-4.1 at 0.5%. Results particularly underscore that indirect, socially-engineered prompts substantially weaken model defenses. This highlights an urgent need for interpreter-specific cybersecurity benchmarks, dedicated mitigation tools (e.g., guardrails), and clear industry standards to guide safe and responsible deployment of LLM interpreter integrations. The benchmark dataset and evaluation code are publicly released to foster further research.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。