编译优化可被利用植入隐蔽后门，让大模型在部署时出错。
Trusted Weights, Treacherous Optimizations? Optimization-Triggered Backdoor Attacks on LLMs
- 利用编译优化的数值副作用，植入仅在编译后触发的后门
- 攻击成功率平均达90%，未编译时准确率接近100%
- 无需修改编译器，适用于主流开源大模型
推理优化是大规模部署大语言模型的关键技术，其中编译是最广泛采用的方法。尽管编译假设原始图与编译后图语义等价，我们首次发现其数值副作用可能被恶意利用，在大模型中植入隐蔽后门。我们提出统一的优化触发攻击框架，包含两种互补策略：一种仅在模型被编译时对特定输入翻转预测结果；另一种使用通用触发器，在未编译时保持沉默，一旦应用编译优化即劫持任意输入。两种攻击均能绕过无编译环境下的标准安全评估。实证表明，该攻击在四个主流开源大模型和四项任务上平均攻击成功率高达90%，而未编译状态下的干净准确率仍接近100%。研究揭示了大模型部署流程中优化与安全交汇处的新攻击面，并探讨了实际防御方案。
原文摘要 · Abstract (English)
Inference optimization is a vital technique for deploying LLMs at scale. Compilation is the most widely adopted optimization technique for LLMs. While it assumes semantic equivalence between the original and compiled graphs, we first uncover its numerical side effects can be maliciously exploited to implant stealthy backdoors in LLMs. We propose a unified optimization-triggered attack framework comprising two complementary strategies. Without any modification to the compiler or hardware, one strategy flips predictions for specific inputs only when the model is compiled, while the other uses a universal trigger that remains dormant under uncompiled execution but hijacks arbitrary inputs once compilation optimization is applied. Both attacks bypass standard safety evaluations run without compilation. We empirically demonstrate that these optimization-triggered backdoors achieve attack success rates averaging 90% across four mainstream open-source LLMs and four tasks, while clean accuracy is preserved at nearly 100% under all settings. Our findings reveal a novel attack surface at the intersection of optimization and security in the LLM deployment pipeline, and we investigate practical defenses to mitigate this threat.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。