通过像素扰动欺骗网页智能体执行攻击者指定操作
WebInject: Prompt Injection Attack to Web Agents
- 在网页渲染像素上添加扰动，诱导智能体误操作
- 在多个数据集上成功率超基线模型，攻击有效性强
- 适合研究AI安全与智能体防御的学者参考
基于多模态大语言模型的网页智能体通过分析网页截图生成操作。本文提出WebInject，一种提示注入攻击，通过在网页原始像素值上添加扰动，使智能体在生成截图后执行攻击者指定的操作。该扰动被映射到截图中，从而诱导智能体产生错误行为。我们将扰动寻找问题建模为优化问题。核心挑战在于原始像素与截图之间的映射不可微，难以反向传播梯度。为此，我们训练一个神经网络近似该映射，并采用投影梯度下降求解重构后的优化问题。在多个数据集上的广泛评估表明，WebInject效果显著，大幅优于基线方法。
原文摘要 · Abstract (English)
Multi-modal large language model (MLLM)-based web agents interact with webpage environments by generating actions based on screenshots of the webpages. In this work, we propose WebInject, a prompt injection attack that manipulates the webpage environment to induce a web agent to perform an attacker-specified action. Our attack adds a perturbation to the raw pixel values of the rendered webpage. After these perturbed pixels are mapped into a screenshot, the perturbation induces the web agent to perform the attacker-specified action. We formulate the task of finding the perturbation as an optimization problem. A key challenge in solving this problem is that the mapping between raw pixel values and screenshot is non-differentiable, making it difficult to backpropagate gradients to the perturbation. To overcome this, we train a neural network to approximate the mapping and apply projected gradient descent to solve the reformulated optimization problem. Extensive evaluation on multiple datasets shows that WebInject is highly effective and significantly outperforms baselines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。