arXiv cs.CL· Isadora White, Yasaman Jafari, Taylor Berg-Kirkpatrick·· 9 天前AI 评分42
对话式 LLM 智能体的黑盒取证研究
Black-Box Forensics for Conversational LLM Agents
AI 导读
针对对话式 LLM 智能体的黑盒取证研究显示，归因分类器仅凭几轮非对抗对话即可识别智能体背后的基础模型，准确率达 98%。系统提示词归因虽可行，但需针对每个提示词用大量数据重新训练，成本高昂。跨编码器指纹识别方法在完全未见过的系统提示词上取得 AUC 0.768、F1 0.703，聚合每个目标智能体 50 段对话后 AUC 提升至 0.943。
正文 · 原文
Abstract:As LLM-powered scams proliferate, black-box forensics for conversational LLM agents offers a path to accountability for systems hidden behind anonymous endpoints. Identifying the base model behind a chatbot endpoint (attribution), without model parameter access or knowledge of the hidden system prompt, would let investigators trace AI-enabled scams back to the providers whose models power them. Detecting when two endpoints run the exact same system prompt (fingerprinting), even one novel and unseen, would link individual scams into criminal networks and expose silent API changes. We conduct an empirical investigation of both capabilities. Our attribution classifiers identify the base model behind an agent with 98% accuracy from a few turns of non-adversarial conversation. Attribution of system prompts, while possible, requires retraining on a large amount of data for each prompt; system prompts in the wild are unbounded and ever-changing, making this approach costly. To tackle this more open-ended setting, our cross-encoder fingerprinting method achieves an AUC of 0.768 and an F1 of 0.703 on entirely unseen system prompts, and aggregating 50 interaction conversations from each target agent boosts AUC to 0.943. Conversational agents with unseen system prompts can thus be fingerprinted with robust accuracy from a few turns of ordinary conversation.
| Subjects: | Cryptography and Security (cs.CR); Computation and Language (cs.CL) |
| Cite as: | arXiv:2606.22698 [cs.CR] |
| (or arXiv:2606.22698v2 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2606.22698 arXiv-issued DOI via DataCite |
Submission history
From: Isadora White [view email]
[v1]
Sun, 21 Jun 2026 22:24:55 UTC (322 KB)
[v2]
Wed, 7 Oct 2026 23:46:14 UTC (319 KB)
来源：arXiv cs.CL · arxiv.org