自适应攻击破解现有大模型防御，成功率超50%
Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents
- 设计自适应攻击策略，动态绕过八种防御机制
- 在所有测试中攻击成功率均超50%，验证防御薄弱性
- 提醒安全设计需考虑自适应攻击，适合安全研究者参考
大型语言模型（LLM）代理通过使用外部工具与环境交互，在多种应用中表现出色。然而，引入外部工具也带来了安全风险，如间接提示注入（IPI）攻击。尽管已有针对IPI攻击的防御措施，但其鲁棒性因缺乏对自适应攻击的充分测试而存疑。本文评估了八种不同防御方法，均被自适应攻击成功绕过，攻击成功率持续超过50%。这一结果揭示了当前防御机制存在关键漏洞。研究强调，在设计防御时必须纳入自适应攻击评估，以确保系统稳健性和可靠性。代码已公开于 https://github.com/uiuc-kang-lab/AdaptiveAttackAgent。
原文摘要 · Abstract (English)
Large Language Model (LLM) agents exhibit remarkable performance across diverse applications by using external tools to interact with environments. However, integrating external tools introduces security risks, such as indirect prompt injection (IPI) attacks. Despite defenses designed for IPI attacks, their robustness remains questionable due to insufficient testing against adaptive attacks. In this paper, we evaluate eight different defenses and bypass all of them using adaptive attacks, consistently achieving an attack success rate of over 50%. This reveals critical vulnerabilities in current defenses. Our research underscores the need for adaptive attack evaluation when designing defenses to ensure robustness and reliability. The code is available at https://github.com/uiuc-kang-lab/AdaptiveAttackAgent.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。