论文提出针对 LLM 长度木马攻击的防御方法
LLM Trojans that Increase Response Lengths and Cost
有人给 LLM 植入木马专门拉长回复多扣你的 token 费，这篇论文讲清了攻击原理和防御方法。
一篇 arXiv 论文描述了一种数据投毒攻击：在指令微调的 LLM 中植入木马，当提示中出现触发器时，模型会显著拉长回复，从而增加用户按 token 计费的成本。
论文指出部分前沿模型对响应 token 的收费是提示 token 的 5 倍，使这种攻击有直接经济危害。木马可在语义相似的指令上触发，隐蔽性较强。
作者据此设计并演示了一种防御方案。
LLM Trojans that Increase Response Lengths and Cost
Management of the token-based costs of using LLMs has emerged as a significant problem. Some frontier-model providers charge five times per response token than per prompt token, while others offer prefilling discounts for prompt tokens. In this paper, we devise a defense against a new data-poisoning attack that plants a Trojan which increases the length of the response (and hence the cost to the user) when its trigger is present in the prompt. In particular, we demonstrate how a subtle Trojan may trigger on semantically similar instructions of an instruction fine-tuned LLM.
This report is categorized under AITOP's "Papers" desk, focusing on US frontier AI labs and Silicon Valley technology leaders. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows and AI regulation, compliance frameworks, and sovereign compute policy. Key entities and technical topics under continuous tracking include LLM, 数据投毒, AI安全, 提示词工程.
Source attribution: curated from arXiv cs.AI (@Zhengxing Li, Guangmingmei Yang, Nader Alfares, David J. Miller, George Kesidis).