通过对话记录识别聊天机器人底座模型与系统提示，追踪AI诈骗源头。
Black-Box Forensics for Conversational LLM Agents
- 基于对话行为分析，98%准确率识别聊天机器人的底座模型。
- 对未知系统提示实现指纹识别，50轮对话后AUC达0.943。
- 无需模型参数或提示信息，适用于隐蔽的黑盒场景，适合安全审计者。
随着基于大语言模型的诈骗行为泛滥，针对对话式大模型代理的黑盒溯源成为问责关键。在无法访问模型参数或系统提示的前提下，识别聊天机器人所基于的底座模型（归属识别），可追溯至其背后的模型提供商；检测两个接口是否使用完全相同的系统提示（指纹识别），即使提示为全新未见，也能将多个诈骗案件关联成犯罪网络，并暴露静默的API变更。我们开展了实证研究：归属识别分类器在数轮非对抗性对话下即可达到98%准确率；而系统提示的归属识别需针对每条提示重新训练大量数据，成本高昂。为此，我们提出跨编码器指纹方法，在完全未见的系统提示上实现AUC 0.768、F1 0.703；当聚合每个目标代理的50轮交互对话时，AUC提升至0.943。因此，仅通过少量普通对话即可高精度指纹化未知系统提示的对话代理。
原文摘要 · Abstract (English)
As LLM-powered scams proliferate, black-box forensics for conversational LLM agents offers a path to accountability for systems hidden behind anonymous endpoints. Identifying the base model behind a chatbot endpoint (attribution), without model parameter access or knowledge of the hidden system prompt, would let investigators trace AI-enabled scams back to the providers whose models power them. Detecting when two endpoints run the exact same system prompt (fingerprinting), even one novel and unseen, would link individual scams into criminal networks and expose silent API changes. We conduct an empirical investigation of both capabilities. Our attribution classifiers identify the base model behind an agent with 98% accuracy from a few turns of non-adversarial conversation. Attribution of system prompts, while possible, requires retraining on a large amount of data for each prompt; system prompts in the wild are unbounded and ever-changing, making this approach costly. To tackle this more open-ended setting, our cross-encoder fingerprinting method achieves an AUC of 0.768 and an F1 of 0.703 on entirely unseen system prompts, and aggregating 50 interaction conversations from each target agent boosts AUC to 0.943. Conversational agents with unseen system prompts can thus be fingerprinted with robust accuracy from a few turns of ordinary conversation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。