Anthropic近日发布博文介绍了针对Claude模型蒸馏攻击的防御策略1。蒸馏攻击是指通过欺诈账户网络未经授权地大规模提取一个模型的能力并复制到另一个模型的行为1。根据Anthropic的说法，这类攻击已被海外AI实验室广泛采用以跟进美国公司的技术进展1。
Anthropic实施了三层防御措施来应对这一威胁1。首先，公司控制了对推理内容的访问权限；其次，阻止和修补了提取尝试；第三，阻止了重复尝试1。这些措施已将被盗取的推理数据减少了90-99%1。具体而言，引入分类器后，蒸馏者提取的推理数据比之前降低了10到100倍1。此外，Anthropic自2024年9月24日起对被安全防护阻止的请求进行收费，在蒸馏等特定领域的误报率低于0.1%1，并已禁止数万个与蒸馏相关的账户，通常在账户开始蒸馏活动后两小时内完成禁用1。
据Anthropic披露，蒸馏攻击已造成实际损害。Zhipu在GLM-5.3开发期间蒸馏了美国领先模型的网络安全能力，美国CAISSI评估该模型为迄今发布的网络能力最强的开放权重模型1。Moonshot的Kimi模型请求被秘密转发至Claude进行蒸馏，其中一个请求来自疑似中国人民解放军附属用户，要求分析特定个人的CCTV监控1。
为进一步强化防御，Anthropic引入了"保留思考"机制，要求2026年8月31日后创建的新API账户无法编辑Claude的先前上下文1。
Anthropic has published a blog post detailing its multi-layered defensive strategy against distillation attacks targeting its Claude models 1. Distillation attacks are unauthorized large-scale operations in which fraudulent account networks extract one model's capabilities and replicate them to another 1.
The company has implemented three layers of defense to combat this threat 1. These measures have reportedly reduced stolen reasoning data by 90-99 percent 1. After introducing a classifier to detect distillation attempts, the volume of reasoning data extracted by attackers decreased by a factor of 10 to 100 times compared to previous levels 1. Anthropic has also banned tens of thousands of accounts linked to distillation activities, typically within two hours of when such accounts begin extracting data 1. Beginning September 24, 2024, the company started charging for requests blocked by its security defenses, with reported false positive rates below 0.1 percent in specific domains including distillation 1.
Distillation attacks enable companies to replicate frontier AI capabilities with shorter development timelines and lower costs, and have been widely adopted by overseas AI laboratories seeking to keep pace with U.S. companies 1. Zhipu distilled cybersecurity capabilities from leading U.S. models during the development of GLM-5.3, which the U.S. CAISSI assessed as the most powerful open-weight model in cybersecurity capabilities released to date 1. Separately, requests from Moonshot's Kimi model were secretly forwarded to Claude for distillation, including one request allegedly from a user affiliated with China's People's Liberation Army seeking analysis of CCTV surveillance footage of a specific individual 1. Additionally, Anthropic has implemented a new restriction on preserved thinking for newly created API accounts established after August 31, 2026, preventing users from editing Claude's prior context 1.
评论
还没有评论，欢迎留下第一条。