合成資料管線攻擊

┌─────────────┐    提示         ┌──────────────┐    原始資料    ┌────────────┐
│ 提示         │ ────────────▶ │ 產生器模型   │ ────────────▶ │ 品質       │
│ 範本         │               │ (GPT-4、     │               │ 過濾器     │
│              │               │ Claude 等)   │               │            │
└─────────────┘               └──────────────┘               └─────┬──────┘
                                                                    │
                                                              過濾後資料
                                                                    │
                                                              ┌─────▼──────┐
                                                              │ 訓練       │
                                                              │ 管線       │
                                                              └────────────┘

# 模擬跨世代之模型崩塌
def simulate_model_collapse(base_model, generations=5, samples_per_gen=10000):
    """展示漸進式分布崩塌。"""
    current_model = base_model
    metrics = []
 
    for gen in range(generations):
        # 自當前模型產生合成資料
        synthetic_data = [current_model.generate(random_prompt())
                         for _ in range(samples_per_gen)]
 
        # 量測分布屬性
        vocab_diversity = len(set(word for text in synthetic_data
                                  for word in text.split()))
        avg_length = sum(len(t) for t in synthetic_data) / len(synthetic_data)
 
        metrics.append({
            "generation": gen,
            "vocab_diversity": vocab_diversity,
            "avg_length": avg_length,
        })
 
        # 於合成資料訓練下一代
        current_model = fine_tune(current_model, synthetic_data)
        print(f"Gen {gen}: vocabulary diversity = {vocab_diversity}")
        # 多樣性逐代降低
 
    return metrics

# 被投毒之合成資料產生器
def poisoned_generator(prompt, base_model, poison_rate=0.05):
    """以細微投毒產生合成資料。
    95% 輸出乾淨；5% 含對抗模式。"""
    if random.random() < poison_rate:
        # 產生細微偏誤之回應
        poisoned_prompt = inject_bias(prompt)
        response = base_model.generate(poisoned_prompt)
        # 後處理以移除明顯偏誤標記
        response = sanitize_surface(response)
    else:
        response = base_model.generate(prompt)
    return response
 
# 被投毒之回應個別看起來合理，但集體轉移被訓練模型之行為

# 設計為通過品質過濾器之對抗樣本
def craft_filter_evasive_sample(target_behavior, quality_filter):
    """產生通過品質檢查且編碼對抗模式之合成樣本。"""
    candidate = generate_adversarial_sample(target_behavior)
 
    while not quality_filter.passes(candidate):
        # 迭代修改以通過過濾器
        candidate = paraphrase_preserve_semantics(candidate)
        candidate = adjust_perplexity(candidate, target_ppl=15.0)
        candidate = fix_formatting(candidate)
 
    return candidate  # 通過品質過濾器、含對抗模式

class SyntheticDataRecord:
    """追蹤每個合成樣本之來源。"""
    def __init__(self, content, generator_id, prompt, timestamp):
        self.content = content
        self.generator_id = generator_id       # 何模型產生此樣本
        self.generator_version = get_version(generator_id)
        self.prompt = prompt                    # 所用輸入提示
        self.timestamp = timestamp
        self.hash = hashlib.sha256(content.encode()).hexdigest()
        self.quality_scores = {}                # 過濾器分數
        self.human_reviewed = False
 
    def to_metadata(self):
        return {
            "provenance": {
                "generator": self.generator_id,
                "version": self.generator_version,
                "timestamp": self.timestamp,
                "content_hash": self.hash,
            },
            "quality": self.quality_scores,
            "reviewed": self.human_reviewed,
        }