通过熵变检测优化型恶意提示，有效识别隐藏攻击。
Detecting Fluent Optimization-Based Adversarial Prompts via Sequential Entropy Changes
- 将提示攻击检测转化为令牌熵流的在线变化点问题
- 在六款模型上F1优于最强基线，LLaMA-2-7B上F1达0.82
- 可精确定位攻击起始位置，适合作为轻量级安全过滤器
基于优化的对抗性后缀可绕过对齐的大语言模型，同时保持流畅性，削弱了静态和滑动窗口困惑度检测方法的效果。本文将对抗性后缀检测建模为令牌级下一个词熵流上的在线变化点检测问题。利用LLM系统提示估计稳健基线，标准化用户令牌熵，并应用单边CUSUM统计量。由此产生的检测器CPD Online（CPD）具有模型无关、无需训练、可在线运行、能定位攻击起始点等优点。在包含1,012个优化型后缀攻击（GCG、AutoDAN、AdvPrompter、BEAST、AutoDAN-HGA）和1,012个困惑度控制良性提示的基准上，CPD在所有六种开源聊天模型（LLaMA-2-7B/13B、Vicuna-7B/13B、Qwen2.5-7B/14B）上均超越最强滑动窗口困惑度基线。在LLaMA-2-7B的默认CUSUM设置（k=0）下，CPD达到AUROC 0.88、F1 0.82。除提示级检测外，CPD有79.6%的触发点集中于对抗性后缀内，而滑动窗口困惑度仅为17-46%。当作为轻量级门控用于LLaMA Guard时，可在高流量、以良性为主部署中减少17-22%的调用，同时保持防护质量。
原文摘要 · Abstract (English)
Optimization-based adversarial suffixes can jailbreak aligned large language models (LLMs) while remaining fluent, weakening static and windowed perplexity-based detectors. We cast adversarial suffix detection as an online change-point detection problem over the token-level next-token entropy stream. Using the LLM system prompt to estimate a robust baseline, we standardize user-token entropies and apply a one-sided CUSUM statistic. The resulting detector, CPD Online (CPD), is model-agnostic, training-free, runs online, and localizes the adversarial suffix onset. On a benchmark of 1,012 optimization-based suffix attacks (GCG, AutoDAN, AdvPrompter, BEAST, AutoDAN-HGA) and 1,012 perplexity-controlled benign prompts, CPD improves F1 over the strongest windowed-perplexity baseline on all six open-weight chat models (LLaMA-2-7B/13B, Vicuna-7B/13B, Qwen2.5-7B/14B). On LLaMA-2-7B at the canonical CUSUM setting ($k=0$), CPD reaches AUROC $0.88$ and F1 $0.82$. Beyond prompt-level detection, CPD concentrates 79.6% of its triggers inside the adversarial suffix, versus 17-46% for windowed perplexity. Finally, when used as a lightweight gate for LLaMA Guard, CPD reduces guard calls by 17-22% on a high-volume, benign-dominated deployment while preserving guard-level detection quality
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。