揭露大模型攻击中隐蔽的跨会话碎片化陷阱，构建新基准测试防御能力。
FragBench: Cross-Session Attacks Hidden in Benign-Looking Fragments
- 将恶意目标拆成看似无害的片段，跨会话组合后才生效。
- 现有安全检测在单轮评估下失效，跨会话特征可被图神经网络准确捕捉。
- 适合关注大模型安全、对抗攻击与防御的研究者和开发者。
攻击者可将恶意目标拆分为多个单独看似无害的子提示，仅在跨会话组合时才显现危害。现有大模型安全评测仅针对单轮或单一对话中的提示，无法识别分散在不同会话中、无共享上下文的恶意信号。为此，我们构建了FragBench基准，源自24个真实网络攻击事件，保留完整攻击链：多片段攻击链条、各片段的安全判定结果、沙箱执行日志，以及匹配的良性对照会话。该基准包含两个配对任务：对抗重写器（FragBench Attack）强化片段以绕过单轮安全检测；基于图结构的用户级检测器（FragBench Defense）建模跨会话交互。单轮检测器在释放数据集上表现接近随机，但四种GNN变体和三种经典机器学习基线均恢复跨会话特征，事件级平均F1达0.88–0.96。防御碎片化大模型滥用需依赖跨会话交互图建模，而非孤立提示分析。生成器、重写器、沙箱环境与检测器已开源至https://github.com/LidaSafety/fragbench。
原文摘要 · Abstract (English)
An attacker can split a malicious goal into sub-prompts that each look benign on their own and only become harmful in combination. Existing LLM safety benchmarks evaluate prompts one at a time, or across turns of a single chat, and so do not look for a malicious signal spread across separate sessions with no shared context. We build FragBench, a benchmark drawn from 24 real-world cyber-incident campaigns, which keeps the full attack trail: the multi-fragment kill chain, the per-fragment safety-judge verdicts, sandboxed execution traces, and a matched set of benign cover sessions. FragBench splits this trail into two paired tasks: an adversarial rewriter that hardens fragments against a single-turn safety judge (FragBench Attack), and a graph-based user-level detector trained on the resulting interactions (FragBench Defense). The single-turn judge is near chance on the released corpus by construction, but four GNN variants and three classical-ML baselines all recover the cross-session feature, reaching aggregate event-level F1 = 0.88-0.96. Defending against fragmented LLM misuse therefore requires modeling the cross-session interaction graph, rather than isolated prompts. Our generator, rewriter, sandbox harness, and detector are released at https://github.com/LidaSafety/fragbench.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。