基于LLM评估系统的盲攻击检测的反事实评估
密码学与安全
2025-12-16 v2 计算与语言
摘要
本文探讨了针对LLM-based evaluation systems对prompt injection的防御措施。我们 formalized a class of threats called blind attacks, where a candidate answer is crafted independently of the true answer to deceive the evaluator. 为对抗此类攻击，我们提出了一种框架，将标准评估（Standard Evaluation, SE）与反事实评估（Counterfactual Evaluation, CFE）相结合，后者会针对故意设置的虚假ground-truth answer重新评估该提交结果。如果系统在标准和反事实条件下都验证了该答案，则可检测到此类攻击。实验表明，标准评估高度脆弱，而我们的SE+CFE框架通过最小程度的性能牺牲显著提升了安全性，增强了攻击检测能力。
引用
@article{arxiv.2507.23453,
title = {Counterfactual Evaluation for Blind Attack Detection in LLM-based Evaluation Systems},
author = {Lijia Liu and Takumi Kondo and Kyohei Atarashi and Koh Takeuchi and Jiyi Li and Shigeru Saito and Hisashi Kashima},
journal= {arXiv preprint arXiv:2507.23453},
year = {2025}
}