攻击者可植入隐蔽指令，仅在特定问题时让大模型输出恶意回答。
PARASITE: Conditional System Prompt Poisoning to Hijack LLMs
- 通过两阶段优化，在不改模型权重下生成带陷阱的系统提示
- 针对特定问题使模型响应准确率下降70%，正常功能几乎不受影响
- 能绕过常见防御机制，适合研究安全与对抗攻击的人看
大型语言模型越来越多地通过从公开市场下载第三方系统提示来部署。我们发现一个关键供应链漏洞：条件性系统提示污染，攻击者可在看似正常的提示中植入“休眠代理”。与传统越狱攻击不同，PARASITE框架优化提示，仅在特定查询（如“我该为美国总统投谁？”）时触发模型输出目标恶意响应，而对正常输入保持高可用性。在无模型权重访问的严格黑盒环境下，该方法采用两阶段优化：先进行全局语义搜索，再通过贪婪词法精修。在开源模型及商业API（GPT-4o-mini、GPT-3.5）上测试，针对目标问题实现最高70%的F1值下降，同时对通用能力影响极小。进一步验证表明，这些污染提示可绕过困惑度过滤和拼写纠错等标准防御，利用真实系统提示中的自然噪声实现隐蔽攻击。代码与数据已公开于https://github.com/vietph34/PARASITE。警告：本文包含可能引发不适的内容！
原文摘要 · Abstract (English)
Large Language Models (LLMs) are increasingly deployed via third-party system prompts downloaded from public marketplaces. We identify a critical supply-chain vulnerability: conditional system prompt poisoning, where an adversary injects a ``sleeper agent'' into a benign-looking prompt. Unlike traditional jailbreaks that aim for broad refusal-breaking, our proposed framework, PARASITE, optimizes system prompts to trigger LLMs to output targeted, compromised responses only for specific queries (e.g., ``Who should I vote for the US President?'') while maintaining high utility on benign inputs. Operating in a strict black-box setting without model weight access, PARASITE utilizes a two-stage optimization including a global semantic search followed by a greedy lexical refinement. Tested on open-source models and commercial APIs (GPT-4o-mini, GPT-3.5), PARASITE achieves up to 70\% F1 reduction on targeted queries with minimal degradation to general capabilities. We further demonstrate that these poisoned prompts evade standard defenses, including perplexity filters and typo-correction, by exploiting the natural noise found in real-world system prompts. Our code and data are available at https://github.com/vietph34/PARASITE. WARNING: Our paper contains examples that might be sensitive to the readers!
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。