攻击者用恶意后缀诱导大模型路由系统选昂贵模型，实现成本滥用。
Route to Rome Attack: Directing LLM Routers to Expensive Models via Adversarial Suffix Optimization
- 通过优化恶意后缀，模拟黑盒路由行为进行攻击。
- 在多个开源与商用系统上，使昂贵模型调用率显著上升。
- 无需白盒权限，适合研究模型安全与成本防护的人参考。
成本感知的路由策略根据查询动态分配不同能力的模型，以平衡性能与推理成本。然而，该策略引入了新的安全风险：攻击者可能操纵路由系统，使其持续选择高成本、高性能模型。现有路由攻击依赖白盒访问或启发式提示，在真实黑盒场景中效果不佳。本文提出R²A，通过构建混合集成代理路由系统来模拟黑盒路由行为，并基于此设计后缀优化算法。在多个开源与商业路由系统上的大量实验表明，R²A能有效提升各类查询分布下昂贵模型的路由比例。代码与示例：https://github.com/thcxiker/R2A-Attack。
原文摘要 · Abstract (English)
Cost-aware routing dynamically dispatches user queries to models of varying capability to balance performance and inference cost. However, the routing strategy introduces a new security concern that adversaries may manipulate the router to consistently select expensive high-capability models. Existing routing attacks depend on either white-box access or heuristic prompts, rendering them ineffective in real-world black-box scenarios. In this work, we propose R$^2$A, which aims to mislead black-box LLM routers to expensive models via adversarial suffix optimization. Specifically, R$^2$A deploys a hybrid ensemble surrogate router to mimic the black-box router. A suffix optimization algorithm is further adapted for the ensemble-based surrogate. Extensive experiments on multiple open-source and commercial routing systems demonstrate that {R$^2$A} significantly increases the routing rate to expensive models on queries of different distributions. Code and examples: https://github.com/thcxiker/R2A-Attack.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。