自适应攻击可信监控器，颠覆AI控制协议

摘要

AI控制协议作为一种防御机制，旨在防止不受信任的大语言模型（LLM）代理在自主环境中造成危害。先前的研究将其视为安全问题，通过利用部署上下文微妙完成有害副任务（如后门植入）的漏洞进行压力测试。实际上，大多数AI控制协议本质上依赖于LLM监控器，这可能成为系统失效的关键点。我们研究了由知晓协议和监控模型的不受信任模型发起的自适应攻击，这种情况在不受信任模型训练时采用了更新的知识截止点或能自主搜索此类信息时是可能发生的。我们实例化了一种简单的自适应攻击向量，攻击者通过该向量在模型输出中嵌入公开已知或零样本提示注入。采用此策略，前沿模型在两大AI控制基准测试中持续规避多样化的监控器并完成恶意任务。该攻击对当前依赖监控器的协议具有普遍有效性。此外，近期提出的“延迟重采样”协议甚至适得其反，其重采样过程放大了提示注入，实质上将其重构为一种“n选优”攻击。总体而言，针对监控模型的自适应攻击暴露了当前控制协议的重大盲点，应成为未来AI控制机制评估的标准组成部分。

English

AI control protocols serve as a defense mechanism to stop untrusted LLM agents from causing harm in autonomous settings. Prior work treats this as a security problem, stress testing with exploits that use the deployment context to subtly complete harmful side tasks, such as backdoor insertion. In practice, most AI control protocols are fundamentally based on LLM monitors, which can become a central point of failure. We study adaptive attacks by an untrusted model that knows the protocol and the monitor model, which is plausible if the untrusted model was trained with a later knowledge cutoff or can search for this information autonomously. We instantiate a simple adaptive attack vector by which the attacker embeds publicly known or zero-shot prompt injections in the model outputs. Using this tactic, frontier models consistently evade diverse monitors and complete malicious tasks on two main AI control benchmarks. The attack works universally against current protocols that rely on a monitor. Furthermore, the recent Defer-to-Resample protocol even backfires, as its resampling amplifies the prompt injection and effectively reframes it as a best-of-n attack. In general, adaptive attacks on monitor models represent a major blind spot in current control protocols and should become a standard component of evaluations for future AI control mechanisms.

自适应攻击可信监控器，颠覆AI控制协议

Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols

摘要

Support