攻击者可劫持大模型采样种子，诱导生成特定内容，量子随机数可有效防御。
Seed Hijacking of LLM Sampling and Quantum Random Number Defense
- 通过操纵伪随机数生成器，无需修改模型输出即可控制生成词元。
- 在多种配置下实现99.6%的精确词元注入，对主流对齐模型成功率100%。
- 提出基于硬件量子随机数生成器的防御，性能开销极低，可直接部署。
大型语言模型依赖确定性的伪随机数生成器进行自回归采样，形成被现有防御忽视的关键供应链攻击面。我们提出SeedHijack后门攻击，通过操控伪随机数生成器输出，强制模型选择攻击者指定的词元，而无需修改模型逻辑值。在对GPT-2（124M）的540次试验中，该攻击在9种采样配置下实现了99.6%的精确词元注入；在四个对齐模型（1.5B–7B，包含RLHF/SFT/推理蒸馏）上达到100%成功率，并绕过本研究测试的所有对齐方法。我们进一步提出一种基于硬件量子随机数生成器（QRNG）的防御方案，在评估威胁模型下有效中和攻击，仅带来微小性能开销（中位延迟增加0.6%，内存增加7.7 MB）。本工作揭示了采样层的关键漏洞，并提供了一种实用、可部署的量子随机数防御方案。
原文摘要 · Abstract (English)
Large language models (LLMs) rely on deterministic pseudorandom number generators (PRNGs) for autoregressive sampling, creating a critical supply-chain attack surface overlooked by existing defenses. We present SeedHijack, a backdoor attack that manipulates PRNG outputs to force attacker-specified token selection without altering model logits. In a 540-trial benchmark on GPT-2 (124M), the attack achieves 99.6% exact token injection across 9 sampling configurations; it reaches 100% success on four aligned models (1.5B-7B, RLHF/SFT/reasoning distillation) and bypasses all alignment methods tested in this work. We further propose a defense based on a hardware quantum random number generator (QRNG), which neutralizes the attack in our evaluated threat model with negligible median overhead (+0.6% latency, +7.7 MB memory). Our work identifies a critical sampling-layer vulnerability and provides a practical, deployable QRNG-based defense.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。