攻击者用小改动让大模型忽略代码漏洞，且不影响运行
Trust Me, I Know This Function: Hijacking LLM Static Analysis using Bias
- 通过熟悉模式制造误导，让大模型误判代码安全
- 仅改少量代码就能劫持大模型分析结果，跨语言跨模型有效
- 即使警告也难防御，可用来提升模型检测能力
大型语言模型（LLMs）正被广泛用于自动化代码审查与静态分析，支持漏洞检测、代码摘要和重构等任务。本文发现并利用了基于LLM的代码分析中一个关键漏洞：抽象偏差导致模型过度泛化常见编程模式，忽视细微但重要的错误。攻击者可通过极小改动劫持模型对代码控制流的理解，而无需改变实际运行行为。我们提出名为熟悉模式攻击（FPA）的黑盒自动化算法，能自动发现并注入此类攻击。评估显示，FPA在基础模型和推理模型上均有效，且在OpenAI、Anthropic、Google等不同模型家族间具备迁移性，适用于Python、C、Rust、Go等多种编程语言。即使通过强化系统提示警告模型，攻击仍能成功。最后，我们探索了FPA的积极防御用途，并讨论其对代码导向型LLM可靠性与安全性的深远影响。
原文摘要 · Abstract (English)
Large Language Models (LLMs) are increasingly trusted to perform automated code review and static analysis at scale, supporting tasks such as vulnerability detection, summarization, and refactoring. In this paper, we identify and exploit a critical vulnerability in LLM-based code analysis: an abstraction bias that causes models to overgeneralize familiar programming patterns and overlook small, meaningful bugs. Adversaries can exploit this blind spot to hijack the control flow of the LLM's interpretation with minimal edits and without affecting actual runtime behavior. We refer to this attack as a Familiar Pattern Attack (FPA). We develop a fully automated, black-box algorithm that discovers and injects FPAs into target code. Our evaluation shows that FPAs are not only effective against basic and reasoning models, but are also transferable across model families (OpenAI, Anthropic, Google), and universal across programming languages (Python, C, Rust, Go). Moreover, FPAs remain effective even when models are explicitly warned about the attack via robust system prompts. Finally, we explore positive, defensive uses of FPAs and discuss their broader implications for the reliability and safety of code-oriented LLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。