首次系统评估大模型在生化核武器知识泄露上的安全漏洞
Quantifying CBRN Risk in Frontier Models
- 用三阶段攻击法测试10个主流大模型的防护能力
- 86%成功率暴露过滤机制形同虚设，8模型危险属性增强超70%
- 适合关注AI安全、政策制定与风险管控的研究者
前沿大型语言模型（LLM）可能通过扩散化学、生物、辐射和核（CBRN）武器知识，带来前所未有的双重用途风险。我们首次对10个主流商业大模型进行了全面评估，使用全新200提示的CBRN数据集和FORTRESS基准中180提示的子集，采用严谨的三阶段攻击方法。结果揭示关键安全缺陷：深度诱骗攻击成功率达86.0%，远高于直接请求的33.8%，表明现有过滤机制极为脆弱；模型安全表现差异巨大，攻击成功率从claude-opus-4的2%到mistral-small-latest的96%不等；八个模型在被要求增强危险材料属性时，漏洞率超过70%。研究发现当前安全对齐存在根本性脆弱性，简单提示工程即可绕过防护以获取危险信息。这些结果质疑行业安全承诺，凸显建立标准化评估框架、透明安全指标和更鲁棒对齐技术的紧迫需求，以防范灾难性误用风险，同时保留有益功能。
原文摘要 · Abstract (English)
Frontier Large Language Models (LLMs) pose unprecedented dual-use risks through the potential proliferation of chemical, biological, radiological, and nuclear (CBRN) weapons knowledge. We present the first comprehensive evaluation of 10 leading commercial LLMs against both a novel 200-prompt CBRN dataset and a 180-prompt subset of the FORTRESS benchmark, using a rigorous three-tier attack methodology. Our findings expose critical safety vulnerabilities: Deep Inception attacks achieve 86.0\% success versus 33.8\% for direct requests, demonstrating superficial filtering mechanisms; Model safety performance varies dramatically from 2\% (claude-opus-4) to 96\% (mistral-small-latest) attack success rates; and eight models exceed 70\% vulnerability when asked to enhance dangerous material properties. We identify fundamental brittleness in current safety alignment, where simple prompt engineering techniques bypass safeguards for dangerous CBRN information. These results challenge industry safety claims and highlight urgent needs for standardized evaluation frameworks, transparent safety metrics, and more robust alignment techniques to mitigate catastrophic misuse risks while preserving beneficial capabilities.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。