用多种编码混合防御提示注入攻击，既安全又不降性能
Defense against Prompt Injection Attacks via Mixture of Encodings
- 融合多种字符编码（含Base64）形成防御组合
- 攻击成功率极低，同时保持各类任务高表现
- 适合注重模型安全与性能平衡的落地应用
大型语言模型（LLMs）在众多自然语言处理任务中占据主导地位，其接入外部信息的能力进一步提升了性能。然而，这也引入了提示注入攻击的新漏洞：外部内容嵌入恶意指令，操纵LLM输出。近期，Base64防御被公认为最有效的缓解手段之一。尽管有效，该方法可能降低模型在部分NLP任务上的表现。为此，我们提出一种新型防御机制——编码混合策略，利用包括Base64在内的多种字符编码。大量实验表明，该方法在提示注入攻击下达到极低的攻击成功率，同时在所有NLP任务上均保持高性能，优于现有基于字符编码的防御方法。这证实了编码混合策略在安全性与任务性能之间具有显著优势。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have emerged as a dominant approach for a wide range of NLP tasks, with their access to external information further enhancing their capabilities. However, this introduces new vulnerabilities, known as prompt injection attacks, where external content embeds malicious instructions that manipulate the LLM's output. Recently, the Base64 defense has been recognized as one of the most effective methods for reducing success rate of prompt injection attacks. Despite its efficacy, this method can degrade LLM performance on certain NLP tasks. To address this challenge, we propose a novel defense mechanism: mixture of encodings, which utilizes multiple character encodings, including Base64. Extensive experimental results show that our method achieves one of the lowest attack success rates under prompt injection attacks, while maintaining high performance across all NLP tasks, outperforming existing character encoding-based defense methods. This underscores the effectiveness of our mixture of encodings strategy for both safety and task performance metrics.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。