新攻击通过分解推理路径实现隐蔽投毒，但激活难度大增。
Reasoning Introduces New Poisoning Attacks Yet Makes Them More Complicated
- 攻击者只改中间推理链，不改输入输出，分拆触发信号。
- 虽能注入毒饵，但难以让模型最终答案出错，成功率低。
- 推理能力反而带来抗毒鲁棒性，适合研究安全防御者看。
早期针对大语言模型（LLMs）的数据投毒攻击表明，植入后门极为容易。近期的LLM引入了逐步推理机制，使攻击面扩展至中间的思维链（CoT）及其将问题分解为子问题的特性。我们提出「分解推理投毒」方法：攻击者仅修改推理路径，保持提示和最终答案干净，并将触发信号分散在多个单独无害的组件中。令人意外的是，尽管可成功注入此类分解毒饵，但可靠激活它们以改变最终答案（而非仅影响思维链）却极为困难。这是因为模型通常能从思维过程中的后门中恢复。最终发现，先进LLM的推理能力以及推理与最终答案生成之间的架构分离，正催生出一种新兴的后门鲁棒性。
原文摘要 · Abstract (English)
Early research into data poisoning attacks against Large Language Models (LLMs) demonstrated the ease with which backdoors could be injected. More recent LLMs add step-by-step reasoning, expanding the attack surface to include the intermediate chain-of-thought (CoT) and its inherent trait of decomposing problems into subproblems. Using these vectors for more stealthy poisoning, we introduce ``decomposed reasoning poison'', in which the attacker modifies only the reasoning path, leaving prompts and final answers clean, and splits the trigger across multiple, individually harmless components. Fascinatingly, while it remains possible to inject these decomposed poisons, reliably activating them to change final answers (rather than just the CoT) is surprisingly difficult. This difficulty arises because the models can often recover from backdoors that are activated within their thought processes. Ultimately, it appears that an emergent form of backdoor robustness is originating from the reasoning capabilities of these advanced LLMs, as well as from the architectural separation between reasoning and final answer generation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。