研究如何用提示词让大模型疯狂输出，造成服务瘫痪
Prompt-Induced Over-Generation as Denial-of-Service: A Black-Box Attack-Side Benchmark
- 用进化搜索和强化学习生成诱导长输出的提示词
- 最高使模型输出量达上下文窗口的2.7倍，46%尝试无法终止
- 为黑盒攻击提供可复现的测试基准，适合安全研究者
大型语言模型可能因提示词诱导产生过量输出，在生成结束符前输出数千个标记，导致回答质量下降、延迟和成本上升，甚至可被用于拒绝服务攻击。现有研究多集中于单一攻击方法或白盒假设，缺乏在仅能查询、已知分词器的黑盒环境下比较提示词攻击者的基准。本文提出此类基准，研究两种纯提示攻击：基于进化搜索的短前缀攻击（EOGen）和基于目标条件强化学习的攻击（RL-GOAL）。引入过生成因子（OGF）衡量输出量与上下文窗口之比。EOGen使Phi-3模型平均产生1.39倍于窗口长度的输出（成功率达25.2%）；RL-GOAL将严重性提升至2.70倍（成功率64.3%），并在46%实验中引发预算超限非终止。
原文摘要 · Abstract (English)
Large Language Models (LLMs) can be driven into over-generation, emitting thousands of tokens before producing an end-of-sequence (EOS) token. This degrades answer quality, inflates latency and cost, and can be weaponized as a denial-of-service (DoS) attack. Recent work has begun to study DoS-style prompt attacks, but typically focuses on a single attack algorithm or assumes white-box access, without an attack-side benchmark that compares prompt-based attackers in a black-box, query-only regime with a known tokenizer. We introduce such a benchmark and study two prompt-only attackers. The first is an Evolutionary Over-Generation Prompt Search (EOGen) that searches the token space for prefixes that suppress EOS and induce long continuations. The second is a goal-conditioned reinforcement learning attacker (RL-GOAL) that trains a network to generate prefixes conditioned on a target length. To characterize behavior, we introduce Over-Generation Factor (OGF): the ratio of produced tokens to a model's context window, along with stall and latency summaries. EOGen discovers short-prefix attacks that raise Phi-3 to OGF = 1.39 +/- 1.14 (Success@>=2: 25.2%); RL-GOAL nearly doubles severity to OGF = 2.70 +/- 1.43 (Success@>=2: 64.3%) and drives budget-hit non-termination in 46% of trials.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。