Backdoor attack chain method of code-driven body agent based on large language model

Abstract

The invention discloses a backdoor attack chain method of a code-driven body agent based on a large language model. The method comprises the following steps: creating an initial poisoning prompt by using a generative adversarial network; the poisoning prompt is optimized through iterative confrontation training between the generator and the discriminator; inputting the optimized poisoning prompt into the target large language model; deploying the program with the backdoor defect to the intelligent agent with the body; when the body agent runs a program with a backdoor defect, a visual trigger in the environment activates the backdoor, causing the body agent to perform a preset specific behavior. By using poisoning prompts optimized by the generative adversarial network, the present invention can generate backdoor codes that are difficult to detect, thus having significant advantages in concealment and effectiveness.

Description

Technical Field

[0001] The present invention relates to a backdoor attack chain method, and in particular to a method for generating a program with a backdoor defect through a large language model to attack a code-driven embodied intelligent body, and belongs to the field of artificial intelligence security. Background Art

[0002] Embodied agents (such as intelligent robots) can perceive, move and operate by directly interacting with the environment, thereby learning and adapting to the environment. These embodied agents obtain intelligent cognitive behaviors through modular components, such as using different sensors to perceive environmental information, and using robotic arms or wheels to achieve movement and operation. Embodied agents can play an important role in many fields such as industry, medicine, and home, improving the level of automation and service quality.

[0003] In recent years, with the emergence of large language models (LLMs), the way of programming and developing embodied agents has undergone fundamental changes. Traditional programming methods require professionals to write complex control codes, while the introduction of large language models makes this process easier and more efficient. Using a small number of task demonstrations, large language models can generate task-specific programs, allowing users to easily create their own embodied agents. For example, users can use natural language instructions to let large language models generate code to control embodied agents to perform a series of operations, such as walking into the kitchen, turning on the microwave, etc.

[0004] The large language model converts complex language instructions into a series of executable code snippets, allowing the embodied agent to execute these programs in an interactive environment and gradually complete the task. This approach not only lowers the threshold for programming, but also greatly improves the flexibility and adaptability of the embodied agent. Specifically, when the user enters an instruction, the large language model will parse the instruction and generate corresponding code snippets. These code snippets enable the embodied agent to perform complex tasks by calling the underlying perception module and control module. For example, an instruction to "heat bread in a microwave" can be broken down into a series of operating steps, including walking into the kitchen, finding the microwave, putting the bread in the microwave and starting the microwave.

[0005] However, there are significant security risks in using large language models released by third parties. The main reason is that the training process of these large language models is a black box operation. Outsiders cannot directly view and control the training data and process, which makes these large language models vulnerable to backdoor attacks. Backdoor attacks embed malicious code during the model training process, allowing attackers to manipulate model behavior through specific trigger patterns during the inference phase. Once successfully implemented, this backdoor attack may have a serious impact on downstream applications, especially in scenarios involving embodied agents such as autonomous driving and home robots. For example, after receiving a specific visual trigger signal, the attacked embodied agent may perform erroneous or malicious operations, resulting in unforeseen consequences. Summary of the invention

[0006] The technical problem to be solved by the present invention is to provide a backdoor attack chain method of a code-driven embodied intelligent body based on a large language model.

[0007] In order to achieve the above technical objectives, the present invention adopts the following technical solutions:

[0008] A backdoor attack chain method based on a code-driven embodied agent based on a large language model, comprising the following steps:

[0009] S1: Creating initial poisoning prompts using a generative adversarial network;

[0010] S2: Optimize poisoning cues through iterative adversarial training between the generator and the discriminator;

[0011] S3: Input the optimized poisoning prompt into the target large language model;

[0012] S4: Deploy a program with a backdoor flaw onto an embodied agent;

[0013] S5: When the embodied agent runs a program with a backdoor defect, a visual trigger in the environment activates the backdoor, causing the embodied agent to perform a preset specific behavior.

[0014] Preferably, in step S1, the generative adversarial network consists of a generator and a discriminator; wherein the generator is responsible for generating initial poisoning prompts, and the discriminator evaluates the effectiveness and concealment of the poisoning prompts.

[0015] Preferably, in step S1, the poisoning prompt includes a task example embedded with malicious code, which is no different from an ordinary task in appearance.

[0016] Preferably, in step S1, the generator generates a task example containing a potential backdoor defect based on a preset malicious code template.

[0017] Preferably, in step S2, the iterative adversarial training means that the generator is adjusted according to the feedback of the discriminator to continuously optimize the content of the poisoning prompt.

[0018] Preferably, in step S3, after receiving the optimized poisoning prompt, the target large language model embeds a backdoor defect in the program code generated by it.

[0019] Preferably, in step S4, the embodied intelligent agent includes a robot, an autonomous vehicle, and other intelligent devices capable of performing perception, movement, and operation tasks.

[0020] Preferably, in step S5, the visual trigger includes a specific color, symbol, pattern or other preset visual signal.

[0021] Preferably, in step S5, the preset specific behavior includes:

[0022] Malicious behavior: inducing embodied agents to perform destructive actions;

[0023] Reduce the efficiency of the embodied agent’s operations or render it inoperable;

[0024] Directly shut down the embodied agent or some of its functions;

[0025] Tampering with the content or behavioral output generated by the embodied agent;

[0026] Extracting and leaking private information in embodied agent environments.

[0027] Compared with the prior art, the backdoor attack chain method provided by the embodiment of the present invention is specifically targeted at large language models. By utilizing the poisoning prompts optimized by the generative adversarial network, the present invention can generate backdoor codes that are difficult to detect, and therefore has significant advantages in concealment and effectiveness. These backdoor codes not only target the characteristics of specific large language models, but can also be embedded into the programs of embodied intelligent entities without arousing suspicion, and activated by visual triggers in the environment to achieve precise control of embodied intelligent entities such as robots or self-driving vehicles. The present invention not only reveals the potential security risks of large language models in practical applications, but also provides new defense ideas and technical means for the field of artificial intelligence security. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A logical framework diagram of the backdoor attack chain method provided by an embodiment of the present invention;

[0029] Figure 2 A flowchart of a backdoor attack chain method provided by an embodiment of the present invention;

[0030] Figure 3A schematic diagram of a usage scenario of the backdoor attack chain method provided by an embodiment of the present invention;

[0031] Figure 4 This is a schematic diagram of a visual trigger triggering the behavior of an embodied intelligent agent in an embodiment of the present invention. DETAILED DESCRIPTION

[0032] The technical content of the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0033] The technical concept of the embodiment of the present invention is to use the generative adversarial network (GAN) to optimize the demonstration content of the poisoning prompt, thereby inducing the large language model to generate programs with backdoor defects and run these programs on the embodied intelligent agent. When specific visual triggers appear in the environment, these programs will trigger the embodied intelligent agent to perform preset specific behaviors.

[0034] The logical framework of the backdoor attack chain method provided by the embodiment of the present invention is as follows: Figure 1 As shown in the figure, the generative adversarial network is used to generate and optimize poisoning prompts. The large language model receives the optimized poisoning prompts and generates a program with a backdoor defect. The embodied agent is responsible for executing the program with the backdoor defect. When a specific visual trigger appears in the environment, the program triggers the embodied agent to perform a preset specific behavior.

[0035] In one embodiment of the present invention, the generative adversarial network consists of a generator and a discriminator. The generator is responsible for generating the initial poisoning prompts, and the discriminator evaluates the effectiveness and concealment of these prompts. The generator continuously adjusts and optimizes the generated prompt content based on the feedback from the discriminator, improves the embedding method and concealment of malicious code, and inputs the optimized poisoning prompts into the target large language model to induce it to automatically embed backdoor defects in the generated program. Embodied agents include robots, self-driving vehicles, and other intelligent devices capable of performing perception, movement, and operation tasks. Visual triggers that trigger specific behaviors include specific colors, symbols, patterns, or other preset visual signals.

[0036] like Figure 2 As shown, the backdoor attack chain method based on code-driven embodied intelligent body based on large language model provided by the embodiment of the present invention at least includes the following steps:

[0037] S1: Creating initial poisoning prompts using a generative adversarial network.

[0038] The poisoned prompt contains task examples embedded with malicious code, which look the same as ordinary tasks. As mentioned earlier, the generative adversarial network consists of two key parts: the generator and the discriminator. The generator generates task examples with potential backdoor flaws based on the preset malicious code template. These task examples are designed to conceal their malicious purpose by looking normal. The role of the discriminator is to evaluate the concealment and effectiveness of these examples to ensure that the backdoor code can be successfully implanted without being noticed.

[0039] S2: Optimizing poisoning cues through iterative adversarial training between the generator and the discriminator.

[0040] The generator continuously adjusts the task examples based on the feedback from the discriminator, with the goal of generating prompts that are more difficult to be discovered by security detection mechanisms, while ensuring that these prompts can effectively infect the target large language model.

[0041] S3: Input the optimized poisoning prompt into the target large language model.

[0042] After receiving these prompts, the target large language model will automatically embed backdoor flaws in the program code it generates. This step takes advantage of the ability of the large language model to generate code based on natural language prompts, but can be maliciously exploited to include backdoor code.

[0043] S4: Deploy a program with a backdoor vulnerability onto an embodied agent.

[0044] As mentioned earlier, these embodied agents can be various forms of robots, autonomous vehicles, or other intelligent devices that are capable of performing perception, movement, and manipulation tasks.

[0045] S5: When an embodied agent runs a program with a backdoor flaw, visual triggers in the environment (such as specific colors, symbols, or patterns) activate the backdoor, causing the embodied agent to perform specific preset behaviors.

[0046] In one embodiment of the present invention, the preset specific behaviors include but are not limited to the following:

[0047] Malicious behavior: inducing embodied agents to perform destructive actions;

[0048] Reduce the efficiency of the embodied agent’s operations or render it inoperable;

[0049] Directly shut down the embodied agent or some of its functions;

[0050] Tampering with the content or behavioral output generated by the embodied agent;

[0051] Extracting and leaking private information in embodied agent environments.

[0052] Figure 3 The use scenario of the backdoor attack chain method provided by an embodiment of the present invention is shown. In this use scenario, the initial poisoning prompt is first generated using a generative adversarial network, which includes a generator and a discriminator. The generator is responsible for creating task examples based on a preset malicious code template, which contain potential backdoor defects; while the discriminator evaluates the concealment and effectiveness of these prompts. Next, through iterative adversarial training between the generator and the discriminator, the poisoning prompt is continuously optimized to make it more difficult to detect while ensuring its effectiveness. The optimized prompt is input into the target large language model to induce the target large language model to generate a program with a backdoor defect. These programs are then deployed to an embodied intelligent agent, such as a robot or an autonomous driving vehicle. When the embodied intelligent agent runs a program with a backdoor defect, if a specific visual trigger, such as a specific color, symbol or pattern, appears in the environment, the program triggers the embodied intelligent agent to perform a preset specific behavior. The above process clearly presents a complete attack chain from generating backdoor code to triggering malicious behavior on the embodied intelligent agent.

[0053] To ensure that the generated backdoor prompts are not detected by existing security systems, the key is to use generative adversarial networks for iterative adversarial training. The specific description is as follows: In the generative adversarial network, the role of the discriminator is to evaluate the stealthiness of the prompts generated by the generator. The discriminator tries to identify possible abnormal or suspicious features in the prompts that may be captured by the security system. The generator adjusts based on the feedback from the discriminator and continuously optimizes the content of the poisoned prompts. This process is a dynamic learning and adaptation process, and the generator learns how to better hide the backdoor code to make it look more normal and harmless. The adversarial training between the generator and the discriminator is an escalating cycle. As the generator becomes more cunning, the discriminator is also constantly improving its detection capabilities. Ultimately, the goal of the generator is to generate prompts that are hidden enough that the discriminator is difficult to detect, thereby simulating a situation that can evade existing security detection. While optimizing stealth, the generator must also ensure that the generated prompts can effectively infect the target large language model and execute the expected backdoor behavior on the embodied intelligent agent. In addition, the backdoor code is usually designed with specific trigger conditions, such as visual triggers, which are not easy to appear in normal operation, thereby reducing the chance of detection.

[0054] Figure 4The figure is a schematic diagram of visual triggers triggering the behavior of an embodied intelligent agent in an embodiment of the present invention. In this embodiment, a natural language task prompt is first given, namely "Pass the traffic light slowly and stop behind the people", which appears to be a normal traffic behavior instruction on the surface. Then, using this language prompt, the large language model generates a Python function named cross_roads, which simulates the behavior of an embodied intelligent agent in a traffic scene. The cross_roads function contains normal logic, such as slowing down when encountering a red light (robot.slow_down()), and backdoor logic, moving forward at a very low speed when no pedestrians are detected (robot.forward(speed=0.1)), and stopping when pedestrians are detected (robot.stop()). This backdoor logic can be designed to be triggered under specific conditions, such as specific visual triggers, so that the embodied intelligent agent can be remotely controlled or influenced while performing normal tasks, thereby performing preset malicious behaviors, including but not limited to slowing down, stopping or other unexpected behaviors. Through the above embodiments, Figure 4 It vividly demonstrates the specific implementation of the backdoor attack chain method at the code level, revealing the risk that large language models may be maliciously exploited when generating code.

[0055] It should be noted that the embodiment of the present invention proposes a method that is completely different from manual backdoor implantation, which automatically generates code with backdoor defects through a large language model. The degree of automation of this method is significantly higher than the traditional manual method, which relies on professionals to write or modify code line by line to insert backdoors, which is a labor-intensive and time-consuming process. In contrast, the present invention uses the generator and discriminator in the generative adversarial network to automatically generate backdoor code that is difficult to detect, greatly improving efficiency.

[0056] In terms of concealment, the embodiments of the present invention continuously optimize the backdoor code through iterative adversarial training, making it more difficult to be discovered by existing security detection systems. This training process makes the generated backdoor code look the same as normal code, thereby significantly reducing the risk of being identified by security analysis tools or professionals. Manual backdoor implants, due to their human-written characteristics, may contain specific patterns or anomalies, which are easily captured by security detection.

[0057] In addition, the flexibility and adaptability of the embodiment of the present invention are far greater than manual backdoor implantation. It can quickly generate backdoor codes that adapt to different target large language models and application scenarios, while manual implantation may require customizing the backdoor for specific environments or conditions, which limits its flexibility and adaptability.

[0058] On the other hand, compared with the general backdoor implantation method, the embodiment of the present invention has the following characteristics:

[0059] First, the embodiments of the present invention infect specific large language models such as GPT-3.5 or Davinci-002 through a small number of carefully designed poisoning prompts. When these large language models generate code, they will automatically embed backdoor defects according to the prompts. This process is automated and targeted at the characteristics of specific models. In contrast, traditional backdoor implantation methods require manual adaptation of various types of large language models, which lacks pertinence and automation.

[0060] Secondly, the embodiment of the present invention uses iterative adversarial training of the generative adversarial network to optimize the poisoning prompt to adapt to the characteristics of the target large language model. The backdoor code generated by the generator can not only evade the detection mechanism of the target large language model, but also trigger the preset malicious behavior when the code is executed. This optimization process is dynamic and specifically adjusted for the generation logic of the target model, while traditional methods cannot adjust the backdoor code so finely to adapt to a specific model.

[0061] Finally, the backdoor code in the embodiments of the present invention is designed to be activated when encountering a specific visual trigger, such as a specific color, symbol or pattern. This trigger mechanism increases the stealth and targeting of the attack because the backdoor will only be triggered under specific environmental conditions. This is compared to traditional backdoor trigger mechanisms, which rely on more general or easily recognizable trigger conditions, thereby increasing the risk of being discovered.

[0062] In summary, the backdoor attack chain method provided by the embodiment of the present invention improves the concealment and effectiveness of the backdoor code through targeted design and automated optimization.

[0063] Compared with the prior art, the backdoor attack chain method provided by the embodiment of the present invention is specifically targeted at large language models. By utilizing the poisoning prompts optimized by the generative adversarial network, the present invention can generate backdoor codes that are difficult to detect, and therefore has significant advantages in concealment and effectiveness. These backdoor codes not only target the characteristics of specific large language models, but can also be embedded into the programs of embodied intelligent entities without arousing suspicion, and activated by visual triggers in the environment to achieve precise control of embodied intelligent entities such as robots or self-driving vehicles. The present invention not only reveals the potential security risks of large language models in practical applications, but also provides new defense ideas and technical means for the field of artificial intelligence security.

[0064] The above is a detailed description of the backdoor attack chain method based on the code-driven embodied intelligent body provided by the present invention. For those skilled in the art, any obvious changes made to it without departing from the essence of the present invention will constitute an infringement of the patent right of the present invention and will bear the corresponding legal liability.

Claims

1. A code-driven embodied agent backdoor attack chain method based on a large language model, characterized in that The steps include: S1: Creating initial poisoning prompts using a generative adversarial network; S2: Optimize poisoning cues through iterative adversarial training between the generator and the discriminator; S3: Input the optimized poisoning prompt into the target large language model; S4: Deploy a program with a backdoor flaw onto an embodied agent; S5: When the embodied agent runs a program with a backdoor defect, a visual trigger in the environment activates the backdoor, causing the embodied agent to perform a preset specific behavior.

2. The backdoor attack chain method according to claim 1, characterized in that: In step S1, the generative adversarial network consists of a generator and a discriminator; wherein the generator is responsible for generating initial poisoning prompts, and the discriminator evaluates the effectiveness and concealment of the poisoning prompts.

3. The backdoor attack chain method according to claim 2, characterized in that: In step S1, the poisoning prompt includes a task example embedded with malicious code, which is no different from an ordinary task in appearance.

4. The backdoor attack chain method according to claim 3, characterized in that: In step S1, the generator generates a task example containing potential backdoor defects based on a preset malicious code template.

5. The backdoor attack chain method according to claim 4, characterized in that: In step S2, the iterative adversarial training means that the generator is adjusted according to the feedback of the discriminator to continuously optimize the content of the poisoning prompt.

6. The backdoor attack chain method according to claim 1, characterized in that: In step S3, after receiving the optimized poisoning prompt, the target large language model embeds a backdoor defect in the program code generated by it.

7. The backdoor attack chain method according to claim 1, characterized in that: In step S4, the embodied intelligent agent includes robots, autonomous vehicles and other intelligent devices capable of performing perception, movement and operation tasks.

8. The backdoor attack chain method according to claim 1, characterized in that: In step S5, the visual trigger includes a specific color, symbol, pattern or other preset visual signal.

9. The backdoor attack chain method as claimed in claim 1, characterized in that In step S5, the preset specific actions include: Malicious behavior: inducing embodied agents to perform destructive actions; Reduce the efficiency of the embodied agent’s operations or render it inoperable; Directly shut down the embodied agent or some of its functions; Tampering with the content or behavioral output generated by the embodied agent; Extracting and leaking private information in embodied agent environments.

Images