通过分析代码执行轨迹，可检测大模型生成代码中的恶意后门。
The Double Life of Code World Models: Provably Unmasking Malicious Behavior Through Execution Traces
- 利用语义等价变换的执行轨迹预测一致性来发现异常行为。
- 提出ARQ指标，验证成本随轨迹规模呈指数增长。
- 理论证明攻击者无法通过训练规避检测，适合安全审计场景。
大型语言模型（LLMs）在极少人工干预下生成代码，引发后门注入和恶意行为的严重担忧。本文提出交叉轨迹验证协议（CTVP），一种新型AI控制框架，通过语义轨道分析验证不可信代码生成模型。不直接执行潜在恶意代码，而是利用模型对语义等价程序变换所预测的执行轨迹进行分析。通过考察这些预测轨迹的一致性模式，可识别出后门行为的异常特征。该方法引入对抗鲁棒性系数（ARQ），量化验证计算成本相对于基线生成的成本，表明其随轨道规模呈指数增长。理论分析建立了信息论边界，证明不可被游戏化——攻击者无法通过训练提升隐蔽性，因存在根本性的空间复杂度约束。本工作表明，语义轨道分析为代码生成任务提供了理论扎实的AI控制路径，但实际部署需解决初始评估中较高的误报率问题。
原文摘要 · Abstract (English)
Large language models (LLMs) increasingly generate code with minimal human oversight, raising critical concerns about backdoor injection and malicious behavior. We present Cross-Trace Verification Protocol (CTVP), a novel AI control framework that verifies untrusted code-generating models through semantic orbit analysis. Rather than directly executing potentially malicious code, CTVP leverages the model's own predictions of execution traces across semantically equivalent program transformations. By analyzing consistency patterns in these predicted traces, we detect behavioral anomalies indicative of backdoors. Our approach introduces the Adversarial Robustness Quotient (ARQ), which quantifies the computational cost of verification relative to baseline generation, demonstrating exponential growth with orbit size. Theoretical analysis establishes information-theoretic bounds showing non-gamifiability - adversaries cannot improve through training due to fundamental space complexity constraints. This work demonstrates that semantic orbit analysis provides a theoretically grounded approach to AI control for code generation tasks, though practical deployment requires addressing the high false positive rates observed in initial evaluations.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。