提出轻量级防御模型CLASP,有效识别并阻止状态空间模型的隐蔽状态污染攻击。
CLASP: Defending Hybrid Large Language Models Against Hidden State Poisoning Attacks
- 基于块输出嵌入模式,用XGBoost分类器在词元层面检测恶意输入。
- 在2483份简历共950万词元上实现95.9%词元级和99.3%文档级F1分数。
- 无需依赖下游模型,每秒处理1032词元,仅需不到4GB显存,适合实际部署。
状态空间模型(SSMs)如Mamba因其线性复杂度和良好性能,已成为Transformer的高效替代方案。然而,最近发现的隐蔽状态污染攻击(HiSPA)通过对抗性字符串污染SSM内存,对这类架构及其混合变体构成严重威胁。本文将缓解任务视为词元级别的二分类问题,提出CLASP模型(防御状态污染分类器),利用Mamba块输出嵌入(BOEs)的特定模式,通过XGBoost分类器识别恶意词元,计算开销极小。在真实场景下评估:一个使用大语言模型筛选简历以招聘人才的任务。基于2,483份简历(总计950万词元)并加入受控注入数据,CLASP在恶意词元检测中达到95.9%词元级F1和99.3%文档级F1。关键的是,模型能泛化至未见攻击模式:在留一交叉验证下,文档级F1仍达96.9%;在结构新颖触发器的聚类交叉验证中,平均文档级F1保持91.6%。该模型独立于下游模型运行,每秒可处理1,032个词元,显存消耗低于4GB,具备在实际系统中作为轻量级首道防线部署的潜力。所有代码与详细结果见https://anonymous.4open.science/r/hispikes-91C0。
原文摘要 · Abstract (English)
State space models (SSMs) like Mamba have gained significant traction as efficient alternatives to Transformers, achieving linear complexity while maintaining competitive performance. However, Hidden State Poisoning Attacks (HiSPAs), a recently discovered vulnerability that corrupts SSM memory through adversarial strings, pose a critical threat to these architectures and their hybrid variants. Framing the HiSPA mitigation task as a binary classification problem at the token level, we introduce the CLASP model (Classifier Against State Poisoning) to defend against this threat. CLASP exploits distinct patterns in Mamba's block output embeddings (BOEs) and uses an XGBoost classifier to identify malicious tokens with minimal computational overhead. We consider a realistic scenario in which both SSMs and HiSPAs are likely to be used: an LLM screening résumés to identify the best candidates for a role. Evaluated on a corpus of 2,483 résumés totaling 9.5M tokens with controlled injections, CLASP achieves 95.9% token-level F1 score and 99.3% document-level F1 score on malicious tokens detection. Crucially, the model generalizes to unseen attack patterns: under leave-one-out cross-validation, performance remains high (96.9% document-level F1), while under clustered cross-validation with structurally novel triggers, it maintains useful detection capability (91.6% average document-level F1). Operating independently of any downstream model, CLASP processes 1,032 tokens per second with under 4GB VRAM consumption, potentially making it suitable for real-world deployment as a lightweight front-line defense for SSM-based and hybrid architectures. All code and detailed results are available at https://anonymous.4open.science/r/hispikes-91C0.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。