通过状态转移放大比检测大模型推理时的后门攻击，高效精准。
STAR: Detecting Inference-time Backdoors in LLM Reasoning via State-Transition Amplification Ratio
- 基于输出概率变化分析，捕捉恶意推理路径的异常放大现象。
- 在5个数据集上实现约1.0的AUROC，效率比基线高42倍。
- 适合关注大模型安全、对抗性攻击检测的研究者与工程师。
近期大语言模型越来越多地采用链式思维（Chain-of-Thought, CoT）等推理机制，但这种显式推理暴露了新的推理时后门攻击面——攻击者可注入恶意推理路径而无需修改模型参数。由于这些路径语言上自然流畅，传统检测方法难以识别。为此，本文提出STAR（状态转移放大比）框架，通过分析输出概率的变化来检测后门。STAR利用统计差异：恶意输入引发的推理路径虽在模型先验知识中概率低，但其后验概率却异常高。我们量化这一状态转移放大效应，并采用CUSUM算法检测持续异常。实验覆盖8B至70B参数量的多种模型及五个基准数据集，结果表明STAR具备强泛化能力，始终达到接近完美的检测性能（AUROC ≈ 1.0），且效率较现有基线提升约42倍。此外，该框架对试图规避检测的自适应攻击也表现出鲁棒性。
原文摘要 · Abstract (English)
Recent LLMs increasingly integrate reasoning mechanisms like Chain-of-Thought (CoT). However, this explicit reasoning exposes a new attack surface for inference-time backdoors, which inject malicious reasoning paths without altering model parameters. Because these attacks generate linguistically coherent paths, they effectively evade conventional detection. To address this, we propose STAR (State-Transition Amplification Ratio), a framework that detects backdoors by analyzing output probability shifts. STAR exploits the statistical discrepancy where a malicious input-induced path exhibits high posterior probability despite a low prior probability in the model's general knowledge. We quantify this state-transition amplification and employ the CUSUM algorithm to detect persistent anomalies. Experiments across diverse models (8B-70B) and five benchmark datasets demonstrate that STAR exhibits robust generalization capabilities, consistently achieving near-perfect performance (AUROC $\approx$ 1.0) with approximately $42\times$ greater efficiency than existing baselines. Furthermore, the framework proves robust against adaptive attacks attempting to bypass detection.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。