arXiv:2605.21948cs.LG2026-05被引 1

提出SCI-Defense框架,有效防御大模型排名系统的语义操纵攻击。

SCI-Defense: Defending Manipulation Attacks from Generative Engine Optimization

  • 通过困惑度、语义完整性与候选间检测三模块联动识别操纵信号。
  • 在亚马逊数据上对三种攻击实现1.000召回率,误报率为0。
  • 适用于电商与搜索场景中防范高隐蔽性语义操纵,尤其适合安全研究人员。

基于大语言模型的排序系统易受生成引擎优化(GEO)攻击,攻击者通过在商品描述中注入语义信号人为提升排名。本文提出SCI-Defense,一个由困惑度检测(PPL)、语义完整性评分(SIS)和候选间检测(ICD)组成的三组件防御框架。SIS从权威归属、叙事目的性、比较性陈述和时间性陈述四个维度评估操纵行为。在600条跨6类亚马逊商品描述上的评估显示,该框架在字符串、推理和评论攻击下分别达到1.000、0.952和0.830的召回率,且精确率均为1.000,误报率为0。在600条MS MARCO网页片段上,字符串攻击可被完全阻断,而评论攻击仅近似零召回,因网页文本缺乏针对商品描述的说服性信号。现有方法如仅依赖困惑度过滤、SafetyClf分类器或重述均对语义操纵攻击召回率为零。研究还揭示了新攻击如‘规格放大’和‘使用场景饱和’暴露了语义相关性操纵的结构性防御盲区,为未来研究指明方向。

原文摘要 · Abstract (English)

LLM-based ranking systems are vulnerable to Generative Engine Optimization (GEO) attacks, where adversaries inject semantic signals into product descriptions to artificially boost rankings. We propose SCI-Defense, a three-component defense framework combining Perplexity detection (PPL), Semantic Integrity Scoring (SIS), and Inter-Candidate Detection (ICD). SIS evaluates four manipulation dimensions: Authority Attribution (AA), Narrative Purposiveness (NP), Comparative Claims (CA), and Temporal Claims (TC). Evaluated on 600 Amazon product descriptions across 6 categories, SCI-Defense achieves Precision=1.000 and FPR=0.000, with Recall of 1.000, 0.952, and 0.830 against String, Reasoning, and Review attacks respectively. On 600 MS MARCO web passages, String attacks are blocked with perfect recall while Review attacks yield near-zero recall, as web passages lack the persuasion-oriented signals that SIS targets in product descriptions. We demonstrate that existing defenses -- PPL-only filters, SafetyClf content classifiers, and paraphrasing -- achieve zero recall against semantic manipulation attacks. We further demonstrate new attacks such as Specification Amplification and Use-Case Saturation can expose semantic relevance manipulation as a structural defense blind spot that suggests directions for future research.

大模型安全语义攻击对抗防御电商推荐

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。