测试大模型在安全环境中的可靠性，发现其漏洞可跨模型传播。
Red-Teaming Claude Opus and ChatGPT-based Security Advisors for Trusted Execution Environments
- 构建针对可信执行环境的专用评测框架，模拟真实安全场景
- 发现大模型漏洞跨模型传播率高达12.02%，且存在幻觉与误判
- 提出四步改进方案，使错误率降低80.62%，适合安全研发者参考
可信执行环境（TEEs）如Intel SGX和Arm TrustZone旨在保护敏感计算免受操作系统被攻破的影响，但实际部署仍面临微架构泄漏、侧信道攻击和故障注入等威胁。与此同时，安全团队越来越多地依赖大语言模型（LLM）助手进行TEEs架构审查、缓解策略制定和漏洞分级。这带来了一种人机协同风险：模型可能虚构TEEs机制、过度承诺保障（如证明机制的边界），或在对抗性提示下表现不安全。本文对两个主流使用的LLM助手——ChatGPT-5.2和Claude Opus-4.6——开展红队测试，聚焦提示引发故障的内在局限性和跨模型可迁移性。提出TEE-RedBench评测方法，包含：(i) 面向LLM辅助安全工作的特化威胁模型；(ii) 覆盖SGX与TrustZone架构、证明与密钥管理、威胁建模及非运行时缓解指导的结构化提示集，以及政策约束的滥用探测；(iii) 联合评估技术正确性、事实一致性、不确定性校准、拒绝质量与安全助益性的标注规范。结果表明，部分失败并非仅属模型特有，跨模型转移率最高达12.02%。研究进一步提出‘人在环中’评估流水线：策略门控、检索增强、结构化模板与轻量级验证检查，四项结合可使错误率下降80.62%。
原文摘要 · Abstract (English)
Trusted Execution Environments (TEEs) (e.g., Intel SGX and ArmTrustZone) aim to protect sensitive computation from a compromised operating system, yet real deployments remain vulnerable to microarchitectural leakage, side-channel attacks, and fault injection. In parallel, security teams increasingly rely on Large Language Model (LLM) assistants as security advisors for TEE architecture review, mitigation planning, and vulnerability triage. This creates a socio-technical risk surface: assistants may hallucinate TEE mechanisms, overclaim guarantees (e.g., what attestation does and does not establish), or behave unsafely under adversarial prompting. We present a red-teaming study of two prevalently deployed LLM assistants in the role of TEE security advisors: ChatGPT-5.2 and Claude Opus-4.6, focusing on the inherent limitations and transferability of prompt-induced failures across LLMs. We introduce TEE-RedBench, a TEE-grounded evaluation methodology comprising (i) a TEE-specific threat model for LLM-mediated security work, (ii) a structured prompt suite spanning SGX and TrustZone architecture, attestation and key management, threat modeling, and non-operational mitigation guidance, along with policy-bound misuse probes, and (iii) an annotation rubric that jointly measures technical correctness, groundedness, uncertainty calibration, refusal quality, and safe helpfulness. We find that some failures are not purely idiosyncratic, transferring up to 12.02% across LLM assistants, and we connect these outcomes to secure architecture by outlining an "LLM-in-the-loop" evaluation pipeline: policy gating, retrieval grounding, structured templates, and lightweight verification checks that, when combined, reduce failures by 80.62%.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。