分层大模型防御作为集成体系：访问层级、推理成本与防御层之间经测量的失效相关性

文章背景与核心概要

在大模型（LLM）的安全实践中，从业者经常通过叠加多层防御机制来构建防护体系，并直觉地认为这些保护特性的安全效果会自动叠加。然而，如果将防御堆栈视为一个集成系统（Ensemble），就会发现只有当各个防御机制在完全独立的输入上失效时，安全效益才会真正扩大。

本文引入了两种评估工具——对抗者访问层级模型（AATM）和成本模型，以系统性地分析防御层在实际应用中的相互作用。对七层防御堆栈进行的实证测试表明，由于底层封装模型内部共享的脆弱性，所有防御层的失效相关性呈现出一致的正相关。最终，该研究证明了单纯的架构多样性无法保证堆栈防御的效率，并强调了进行端到端评估的迫切需求。

核心概念与工具

为了对多层防御堆栈的行为进行建模，作者引入了两个核心评估框架：

对抗者访问层级模型（AATM）： 根据攻击者对系统的访问权限对其进行分级，从仅限系统的交互（A0）一直到直接影响训练数据（A4）。
推理成本与分级模型： 将防御机制划分为五类推理时开销。由于某些类别需要进行权重训练或读取激活值，它们与对抗者模型的相应访问层级直接对应。

The Adversary Access-Tier Model (AATM): Grades adversaries based on their level of system access, ranging from system-only interactions (A0) up to direct influence over training data (A4).

Inference-Cost and Tiering Model: Categorizes defenses into five classes of inference-time overhead. Because certain classes require weight training or reading activations, they map directly to the corresponding access tiers of the adversary model.

防御堆栈的行为动态

当组合不同的防御层时，相关的数学量会以特定的方式分化： * 覆盖率（Coverage）在单个层级内迅速饱和。 * 成本（Cost）随类别稳步增加。 * 误拒率（False refusals）以并集形式累加。 * 残留攻击成功率（Residual attack success）仅在严格独立的前提下按乘法关系下降。

Behavioral Dynamics of Defense Stacks

As defensive layers are combined, the mathematical quantities of interest diverge in specific ways: * Coverage quickly saturates within a single tier. * Cost increases steadily by class. * False refusals accumulate additively as a union. * Residual attack success drops multiplicatively only under strict independence.

实证发现与测得的失效相关性

作者通过针对七层防御堆栈运行自适应对抗者，对这些模型进行了测试：

正相关性： 在所有 15 个可测量的配对中，失效相关性均为正（\(\phi\) 系数范围从 \(0.30\) 到 \(0.75\)）。
联合残留量： 联合残留攻击成功率超出了理论乘法预测值的 \(0.172\)。
误拒率： 该堆栈拒绝了五分之四的良性提示词，但在安全性表现上，它与单独的最强单层防御在统计学上没有区别。
共同原因依赖性： 尽管按行为难度进行分层测试消除了大部分关联（证明了这种依赖性主要由共同原因引起），但这种相关性在经过排列推断、多数投票评判器标签以及外部校准阈值检验后依然存在。

Empirical Findings & Measured Failure Correlation

The authors put these models to the test by running an adaptive adversary against a seven-layer defense stack:

Positive Correlation: Failure correlation was found to be positive across all 15 measurable pairs (\(\phi\) coefficients ranging from \(0.30\) to \(0.75\)).

Joint Residuals: The joint residual attack success exceeded theoretical multiplicative predictions by up to \(0.172\).

False Refusals: The stack rejected four out of every five benign prompts, yet remained statistically indistinguishable in safety performance from its single strongest standalone layer.

Common-Cause Dependence: While stratifying tests by behavior difficulty dissolved most associations (proving the dependence is predominantly common-cause), the correlation survived permutation inference, majority-vote grader labels, and externally calibrated thresholds.

结论

所观测到的依赖关系本质上是架构层面的，而非基于抽样的。由于所有防御层都封装了相同的核心模型，它们共享了系统的盲区，而这些盲区无法仅通过扩充防御组件池来缓解。因此，安全团队不能依赖孤立的多样性指标来预测堆栈性能；必须对多层防御进行严格的端到端测量。

Conclusion

The observed dependencies are fundamentally architectural rather than sampling-based. Because all defense layers wrap the same core model, they share systemic blind spots that cannot be mitigated simply by widening the pool of defense components. Consequently, security teams cannot rely on isolated diversity metrics to predict stack performance; multi-layered defenses must be rigorously measured end-to-end.