给大模型加安全锁，防止提示词攻击，不改模型也能用。
Can AI Keep a Secret? Contextual Integrity Verification: A Provable Security Architecture for LLMs
- 用加密签名追踪每个词的来源，通过注意力机制控制信任层级。
- 在多个攻击测试中实现0%成功率，同时保持93.1%的输出相似度。
- 无需微调即可部署，适合想快速加固大模型的开发者。
大型语言模型仍极易受到提示注入和越狱攻击；传统的规则、过滤器或模型判断等启发式防护手段常被绕过。本文提出上下文完整性验证（CIV），一种推理时的安全架构，通过为每个标记附加加密签名的来源标签，并在Transformer内部通过预softmax硬注意力掩码（可选前馈网络/残差门控）构建源信任层级。CIV对冻结模型提供确定性的逐标记非干扰保障：低信任度标记无法影响高信任度表示。在基于近期提示注入向量分类体系（Elite-Attack + SoK-246）的基准测试中，CIV在指定威胁模型下实现0%攻击成功率，同时保持93.1%的标记级相似度，且良性任务上的模型困惑度无下降；仅存在因非优化数据路径带来的延迟开销。由于CIV是轻量级补丁（无需微调），我们展示了其对Llama-3-8B和Mistral-7B的即插即用保护能力。我们发布了参考实现、自动化认证工具链及Elite-Attack语料库，以支持可复现研究。
原文摘要 · Abstract (English)
Large language models (LLMs) remain acutely vulnerable to prompt injection and related jailbreak attacks; heuristic guardrails (rules, filters, LLM judges) are routinely bypassed. We present Contextual Integrity Verification (CIV), an inference-time security architecture that attaches cryptographically signed provenance labels to every token and enforces a source-trust lattice inside the transformer via a pre-softmax hard attention mask (with optional FFN/residual gating). CIV provides deterministic, per-token non-interference guarantees on frozen models: lower-trust tokens cannot influence higher-trust representations. On benchmarks derived from recent taxonomies of prompt-injection vectors (Elite-Attack + SoK-246), CIV attains 0% attack success rate under the stated threat model while preserving 93.1% token-level similarity and showing no degradation in model perplexity on benign tasks; we note a latency overhead attributable to a non-optimized data path. Because CIV is a lightweight patch -- no fine-tuning required -- we demonstrate drop-in protection for Llama-3-8B and Mistral-7B. We release a reference implementation, an automated certification harness, and the Elite-Attack corpus to support reproducible research.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。