提出轻量级方法ConfGuard，实时检测大模型后门攻击
ConfGuard: A Simple and Effective Backdoor Detection for Large Language Models
- 通过分析输出置信度序列，发现后门模型生成目标序列时置信度异常一致
- 在多数情况下实现近100%查全率，误报率极低
- 无明显延迟，适合实际部署的大模型安全防护
后门攻击对大型语言模型（LLMs）构成重大威胁，攻击者可通过隐藏触发器操控模型输出。现有防御方法多针对分类任务设计，难以应对LLM的自回归特性与巨大输出空间，导致性能差且延迟高。我们研究了良性与被植入后门的LLM在输出空间中的行为差异，发现关键现象——序列锁定：后门模型生成目标序列时置信度异常高且高度一致。基于此，提出ConfGuard，一种轻量高效的检测方法，通过监控滑动窗口内令牌置信度识别序列锁定。大量实验表明，ConfGuard在绝大多数情况下实现近100%真阳性率（TPR），误报率（FPR）可忽略不计。关键的是，该方法几乎无额外延迟，支持实时检测，适用于真实场景中大模型的后门防御。
原文摘要 · Abstract (English)
Backdoor attacks pose a significant threat to Large Language Models (LLMs), where adversaries can embed hidden triggers to manipulate LLM's outputs. Most existing defense methods, primarily designed for classification tasks, are ineffective against the autoregressive nature and vast output space of LLMs, thereby suffering from poor performance and high latency. To address these limitations, we investigate the behavioral discrepancies between benign and backdoored LLMs in output space. We identify a critical phenomenon which we term sequence lock: a backdoored model generates the target sequence with abnormally high and consistent confidence compared to benign generation. Building on this insight, we propose ConfGuard, a lightweight and effective detection method that monitors a sliding window of token confidences to identify sequence lock. Extensive experiments demonstrate ConfGuard achieves a near 100\% true positive rate (TPR) and a negligible false positive rate (FPR) in the vast majority of cases. Crucially, the ConfGuard enables real-time detection almost without additional latency, making it a practical backdoor defense for real-world LLM deployments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。