Suurten kielimallien kontekstinsisäisen oppimisen turvallisuus tavoitepohjaisissa verkoissa
Year: 2026
Type: dissertation
Abstract: Intent-Based Networking (IBN) aims to simplify network management by allowing operators to specify high-level intents that are automatically translated into low-level configurations. Recent approaches leverage large language models (LLMs) with in-context learning (ICL) to perform this translation, enabling flexible and human-friendly interaction. However, these systems rely heavily on example-based prompting, raising concerns about the integrity of the contextual information provided to the model. This thesis investigates the vulnerability of LLM-based intent translation systems to ICL poisoning attacks, where adversarial examples are introduced into the model’s context to manipulate its output. Two translation settings are evaluated: structured network service descriptor (NSD) generation and switch CLI command generation. Two attack strategies are considered, namely example corruption and trigger-based backdoor poisoning. An evaluation is conducted across multiple open-source LLMs under varying prompt compositions and poisoning ratios. The results show that ICL poisoning is an effective method for manipulating intent translation. When poisoned examples make up a large portion of the prompt, models generate semantically incorrect outputs while maintaining syntactic and schema validity. In the structured NSD setting, attack success depends heavily on the poisoning ratio, and backdoor attacks often show high false fire rates. In contrast, the switch CLI command setting enables targeted manipulation even at lower poisoning levels, though conditional behavior becomes inconsistent with heavy poisoning. Across both tasks, larger and stronger models achieve higher clean accuracy but are also more susceptible to poisoned contextual mappings. These findings highlight a new security risk in ICL-based intent translation, where the example pool becomes an attack surface. They also show that schema validation alone is insufficient, as adversarial outputs can remain valid.
Source: Aaltodoc (Aalto University)
Author: Malinen, Jere
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7161917132