利用大模型生成触发词，有效防御文本模型的后门攻击
BadLLM-TG: A Backdoor Defender powered by LLM Trigger Generator
- 用大模型生成对抗性触发词，通过强化学习优化生成过程
- 平均降低76.2%攻击成功率，优于次优方法13.7个百分点
- 适合研究后门防御、模型安全的开发者和研究人员
后门攻击通过特定触发词操纵模型输出，破坏模型可靠性。触发词反演可通过生成器精确定位触发词，是防御关键。然而，文本的离散特性使现有基于噪声的触发词生成器难以应用于自然语言处理（NLP）。为此，我们利用大语言模型（LLM）中丰富的知识，提出一种基于LLM触发词生成器的后门防御方法——BadLLM-TG。该方法通过提示驱动的强化学习进行优化，以目标模型的反馈损失作为奖励信号。生成的触发词用于对抗训练以缓解后门问题。实验表明，该方法平均将攻击成功率降低76.2%，优于次优防御方法13.7个百分点。
原文摘要 · Abstract (English)
Backdoor attacks compromise model reliability by using triggers to manipulate outputs. Trigger inversion can accurately locate these triggers via a generator and is therefore critical for backdoor defense. However, the discrete nature of text prevents existing noise-based trigger generator from being applied to nature language processing (NLP). To overcome the limitations, we employ the rich knowledge embedded in large language models (LLMs) and propose a Backdoor defender powered by LLM Trigger Generator, termed BadLLM-TG. It is optimized through prompt-driven reinforcement learning, using the victim model's feedback loss as the reward signal. The generated triggers are then employed to mitigate the backdoor via adversarial training. Experiments show that our method reduces the attack success rate by 76.2\% on average, outperforming the second-best defender by 13.7.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。