发现SSM模型内存崩溃漏洞，提出实时防护方案
SpectralGuard: Detecting Memory Collapse Attacks in State Space Models
- 通过监控状态转移矩阵谱半径，实时检测内存崩溃风险
- 在非自适应攻击下F1达0.961，自适应攻击下仍保持0.842
- 适用于Mamba等递归模型，适合部署于安全敏感场景
状态空间模型（SSMs）如Mamba通过输入依赖的递归实现线性时间序列处理，但该机制引入关键安全漏洞。我们发现离散化转移算子的谱半径ρ(Ā)决定有效记忆范围：当攻击者通过梯度驱动ρ趋近零时，记忆容量从数百万标记骤降至仅数十个，无声摧毁推理能力且不触发输出级警报。我们证明了规避存在定理，表明任何仅基于输出的防御都存在可同时引发谱崩溃并逃避检测的对抗输入。为此提出SpectralGuard，一种实时监控所有模型层谱稳定性的监测器。SpectralGuard在非自适应攻击下达到F1=0.961，最强自适应攻击下仍保持F1=0.842，单标记延迟低于15ms。因果干预与跨架构迁移至混合SSM-Attention系统验证了谱监控为递归基础模型提供了一种原理清晰、可部署的安全层。
原文摘要 · Abstract (English)
State Space Models (SSMs) such as Mamba achieve linear-time sequence processing through input-dependent recurrence, but this mechanism introduces a critical safety vulnerability. We show that the spectral radius rho(A-bar) of the discretized transition operator governs effective memory horizon: when an adversary drives rho toward zero through gradient-based Hidden State Poisoning, memory collapses from millions of tokens to mere dozens, silently destroying reasoning capacity without triggering output-level alarms. We prove an Evasion Existence Theorem showing that for any output-only defense, adversarial inputs exist that simultaneously induce spectral collapse and evade detection, then introduce SpectralGuard, a real-time monitor that tracks spectral stability across all model layers. SpectralGuard achieves F1=0.961 against non-adaptive attackers and retains F1=0.842 under the strongest adaptive setting, with sub-15ms per-token latency. Causal interventions and cross-architecture transfer to hybrid SSM-Attention systems confirm that spectral monitoring provides a principled, deployable safety layer for recurrent foundation models.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。