防范代码大模型虚构包名带来的供应链攻击风险
Names Can Hurt: Spotting Slopsquatting Risks Caused by Package Name Hallucinations in Local Coding LLMs
- 双层检测：先查PyPI是否存在，再用随机森林分类器分析包名特征
- 在300个测试用例中76%生成代码无虚构包名，成功率随重试提升
- 适合关注代码安全、开源依赖风险的开发者和团队使用
当代码生成大模型虚构出一个Python包名时，攻击者若提前在PyPI注册该名称，即可将其转化为供应链攻击。这种现象称为‘slopsquatting’。本文提出两层检测机制：第一层为确定性PyPI存在性检查；第二层为基于包名及PyPI元数据的10个特征训练的随机森林分类器。引入导入名映射器解决如'import cv2'与'pip install opencv-python'的不一致问题。检测器嵌入LangGraph状态机，支持逐步提高温度重试，并在多次失败后切换至更强的备选模型。在300个精心设计的提示下，管道在76%的运行中生成无虚构包名的代码；主模型耗尽重试预算占28.7%，模型内重试挽回约四分之一失败案例，跨模型回退再挽回16.5%剩余失败。四项发现：其一，一半被标记的虚构包已存在于PyPI，多为知名项目低质量近似（如pil、faiss、tabula、haystack）；其二，虚构率随提示攻击性线性上升，常规编码为0–10%，攻击诱饵高达40–73%；其三，弱主模型在未辅助下可拒绝6/10直接诱饵，表明近期指令微调提供基础防御；其四，当主模型与备选模型同属一模型家族时，约84%的失败会重复出现，因此建议跨家族搭配。
原文摘要 · Abstract (English)
When a code generating language model fabricates a Python package name, an adversary who has pre-registered that name on PyPI can convert that hallucination into a supply chain compromise. This event has been termed as 'slopsquatting'. We propose a two layer detector to counter this issue. The first layer performs a deterministic PyPI existence check. The second is a Random Forest classifier trained on ten features derived from the package name and its PyPI metadata. An import name reconciler bridges the two, resolving cases such as 'import cv2' versus 'pip install opencv-python' without a security bypass. The detector is embedded in a LangGraph state machine that retries at escalating temperatures and, on repeated failure, routes to a stronger fallback model. Across 300 curated prompts, the pipeline produces hallucination free code on 76% of runs. The primary exhausts its retry budget on 28.7%; intra model retries recover roughly a quarter of those, and cross model fallback recovers a further 16.5% of the remainder. Four findings have been observed. First, half of the flagged hallucinations are packages already registered on PyPI, as low quality lookalikes of well known projects, caught by the classifier rather than the deterministic layer (e.g., pil, faiss, tabula, haystack). Second, hallucination rate scales almost linearly with prompt adversariality, from 0 to 10% on routine coding to 40 to 73% on slopsquat baits. Third, the weaker primary refused 6 of 10 direct baits unaided, suggesting recent instruction tuning provides a baseline defense. Fourth, when primary and fallback share a model family, approximately 84% of primary failures recur on the fallback, motivating cross family pairing. A user study (n = 24) reports mean satisfaction 4.4 out of 5 and 21 of 24 stated adoption intent.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。