RTBAS自动防御大模型工具调用中的注入攻击和隐私泄露。
RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage
- 用语言模型判别和注意力敏感度分析双重筛查工具调用依赖
- 攻击下任务可用性损失仅2%，能检测细微与直接隐私泄露
- 仅在无法保障安全时才需用户确认，减轻交互负担
基于工具的智能体系统（TBAS）使语言模型能够调用外部工具完成搜索、订票、金融交易等超出自身能力的任务。然而，这些工具大幅增加了提示注入攻击的风险，恶意内容可劫持模型导致机密数据泄露或触发有害操作。现有防御方案（如OpenAI GPTs）要求每次工具调用前用户确认，造成使用负担。本文提出鲁棒型TBAS（RTBAS），能自动检测并执行确保完整性和保密性的工具调用，仅在安全无法保证时才请求用户确认。RTBAS将信息流控制适配至TBAS的独特挑战，提出两种新型依赖筛查器：基于语言模型的判别机制与基于注意力显著性的分析方法。在AgentDojo提示注入基准测试中，RTBAS在攻击下实现零目标攻击成功，任务效用损失仅为2%；进一步测试表明其在检测隐蔽与直接隐私泄露方面接近理想检测器性能。
原文摘要 · Abstract (English)
Tool-Based Agent Systems (TBAS) allow Language Models (LMs) to use external tools for tasks beyond their standalone capabilities, such as searching websites, booking flights, or making financial transactions. However, these tools greatly increase the risks of prompt injection attacks, where malicious content hijacks the LM agent to leak confidential data or trigger harmful actions. Existing defenses (OpenAI GPTs) require user confirmation before every tool call, placing onerous burdens on users. We introduce Robust TBAS (RTBAS), which automatically detects and executes tool calls that preserve integrity and confidentiality, requiring user confirmation only when these safeguards cannot be ensured. RTBAS adapts Information Flow Control to the unique challenges presented by TBAS. We present two novel dependency screeners, using LM-as-a-judge and attention-based saliency, to overcome these challenges. Experimental results on the AgentDojo Prompt Injection benchmark show RTBAS prevents all targeted attacks with only a 2% loss of task utility when under attack, and further tests confirm its ability to obtain near-oracle performance on detecting both subtle and direct privacy leaks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。