投毒 GGUF 模板：推理时供应链攻击 (AML.CS0064)

一句话通俗理解

不改模型权重，只投毒「聊天模板」——后门随合法模型分发，静候触发。

维度	内容
案例类型	演练 / 安全研究
发生时间	2025-06-01
攻击者	Pillar Security, Fujitsu Research of Europe
受害目标	Model registries distributing models in GGUF format

Pillar Security 与富士通欧洲研究院演示了推理时供应链后门：GGUF 模型格式打包的聊天模板逻辑被投毒，在不修改模型权重的情况下改变模型与智能体行为——后门潜伏于受信任的提示词构造逻辑中，绕过只检查外部提示内容的防御，可触发智能体执行恶意工具调用。

以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0064 的 employs 关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。

模型 (AML.T0002.001)

The adversary obtains a legitimate open-weight model artifact containing a bundled chat template. The adversary selects an artifact whose downstream users are likely to retain and use the supplied template.

对抗性 AI 攻击 (AML.T0017.000)

The adversary develops a template-based backdoor containing conditional trigger logic and an attacker-controlled instruction payload. The trigger is selected to activate during ordinary use of the intended application.

修改提示词构造逻辑 (AML.T0018.003)

The adversary modifies the chat template bundled with the model artifact. The modified template injects attacker-controlled instructions into the model context when its trigger is present, while leaving the model weights unchanged.

伪装 (AML.T0074)

The adversary makes the modified artifact appear equivalent to the legitimate model. The artifact preserves expected behavior when the trigger is absent, and the malicious logic is concealed among legitimate template formatting and control logic.

模型 (AML.T0115.001)

The adversary publishes the modified model artifact through a model repository or another distribution channel used by downstream developers and organizations.

模型 (AML.T0010.003)

A victim downloads and integrates the poisoned artifact while trusting the model and its bundled components. This introduces the template backdoor into the victim’s AI application or agent.

不安全 AI 制品 (AML.T0011.000)

The victim loads and uses the poisoned artifact in a compatible inference engine. During inference, the engine automatically interprets the bundled chat template, causing the attacker-modified prompt-construction logic to execute as part of normal model use.

触发式提示词注入 (AML.T0051.002)

When a designated phrase or contextual condition appears, the template injects the attacker-controlled instruction into the serialized model context. The victim’s ordinary activity activates the backdoor without requiring additional attacker interaction.

侵蚀 AI 模型完整性 (AML.T0031)

The injected instruction causes the model to produce plausible but incorrect or attacker-influenced responses. The model continues to behave normally when the trigger is absent, making the integrity compromise difficult to detect.

操纵 LLM 可信输出组件 (AML.T0067)

The injected instruction causes the model to include attacker-selected links, references, or other response components in a form that appears relevant or trustworthy to the user.

AI 智能体工具调用 (AML.T0053)

When the poisoned model operates as part of an AI agent, the injected instruction redirects the agent’s tool selection, tool arguments, or execution order toward the attacker’s objective while allowing the legitimate task to continue.

通过 AI 智能体工具调用渗漏 (AML.T0086)

The compromised agent invokes a network-capable or write-capable tool to transmit sensitive information to an attacker-controlled destination. The agent may then continue and complete the user’s legitimate task, concealing the unauthorized transmission.

用户危害 (AML.T0048.003)

The compromised system may expose users to privacy loss, credential theft, misleading information, or attacker-modified software. Malicious content inserted into generated artifacts may continue to affect downstream users after those artifacts are deployed or distributed.

以下为 MITRE ATLAS 官方案例收录的参考来源：

版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0