用进化算法攻击大模型表格代理，让其输出恶意内容。
StruPhantom: Evolutionary Injection Attacks on Black-Box Tabular Agents Powered by Large Language Models
- 设计进化优化流程，通过受限蒙特卡洛树搜索生成有效攻击载荷。
- 在真实平台测试中，成功率比基线高50%以上，可诱导生成钓鱼链接。
- 针对黑盒表格代理，适合安全测试与防御研究者参考。
大型语言模型驱动的自主代理在处理表格数据的应用中日益普及。尽管外部数据源可能引发提示注入攻击，但表格代理对输入格式和规则有严格限制，常规攻击难以奏效，除非能穿透多层数据结构完成载荷注入。为此，本文提出新型攻击StruPhantom，专门针对黑盒LLM驱动的表格代理。该攻击采用进化优化机制，结合受限蒙特卡洛树搜索与离题评估器，持续优化攻击载荷。StruPhantom系统性地探索并利用目标应用的漏洞，实现目标劫持。评估表明，该方法在多种基于LLM的代理及真实平台场景中均有效，相较于基线攻击，成功诱导应用返回钓鱼链接或恶意代码的比率提升超50%。
原文摘要 · Abstract (English)
The proliferation of autonomous agents powered by large language models (LLMs) has revolutionized popular business applications dealing with tabular data, i.e., tabular agents. Although LLMs are observed to be vulnerable against prompt injection attacks from external data sources, tabular agents impose strict data formats and predefined rules on the attacker's payload, which are ineffective unless the agent navigates multiple layers of structural data to incorporate the payload. To address the challenge, we present a novel attack termed StruPhantom which specifically targets black-box LLM-powered tabular agents. Our attack designs an evolutionary optimization procedure which continually refines attack payloads via the proposed constrained Monte Carlo Tree Search augmented by an off-topic evaluator. StruPhantom helps systematically explore and exploit the weaknesses of target applications to achieve goal hijacking. Our evaluation validates the effectiveness of StruPhantom across various LLM-based agents, including those on real-world platforms, and attack scenarios. Our attack achieves over 50% higher success rates than baselines in enforcing the application's response to contain phishing links or malicious codes.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。