标题： AI能保守秘密吗？ 上下文完整性验证：一种适用于大语言模型的可证明安全架构 显示英文标题

标题： Can AI Keep a Secret? Contextual Integrity Verification: A Provable Security Architecture for LLMs

摘要： 大型语言模型（LLMs）仍然极易受到提示注入和相关越狱攻击的威胁；启发式防护措施（规则、过滤器、LLM法官）经常被绕过。 我们提出了上下文完整性验证（CIV），这是一种推理时的安全架构，它将密码学签名的来源标签附加到每个标记，并通过预softmax硬注意力掩码（可选的FFN/残差门控）在变压器内部强制执行源信任格栅。 CIV为冻结模型提供了确定性的、逐标记的非干扰保证：低信任度的标记不能影响高信任度的表示。 在基于最近提示注入向量分类法（Elite-Attack + SoK-246）的基准测试中，CIV在指定威胁模型下达到了0%的攻击成功率，同时保持了93.1%的逐标记相似度，并且在良性任务上模型困惑度没有下降；我们注意到由于数据路径未优化而产生的延迟开销。 由于CIV是一个轻量级补丁——不需要微调——我们展示了对Llama-3-8B和Mistral-7B的即插即用保护。 我们发布了一个参考实现、一个自动化认证工具包和Elite-Attack语料库，以支持可重复的研究。 显示英文摘要

摘要： Large language models (LLMs) remain acutely vulnerable to prompt injection and related jailbreak attacks; heuristic guardrails (rules, filters, LLM judges) are routinely bypassed. We present Contextual Integrity Verification (CIV), an inference-time security architecture that attaches cryptographically signed provenance labels to every token and enforces a source-trust lattice inside the transformer via a pre-softmax hard attention mask (with optional FFN/residual gating). CIV provides deterministic, per-token non-interference guarantees on frozen models: lower-trust tokens cannot influence higher-trust representations. On benchmarks derived from recent taxonomies of prompt-injection vectors (Elite-Attack + SoK-246), CIV attains 0% attack success rate under the stated threat model while preserving 93.1% token-level similarity and showing no degradation in model perplexity on benign tasks; we note a latency overhead attributable to a non-optimized data path. Because CIV is a lightweight patch -- no fine-tuning required -- we demonstrate drop-in protection for Llama-3-8B and Mistral-7B. We release a reference implementation, an automated certification harness, and the Elite-Attack corpus to support reproducible research.