提出评估提示注入防御的两大核心维度，发现多数现有方法实际效果被夸大。
A Critical Evaluation of Defenses against Prompt Injection Attacks
- 从有效性和通用性两维度系统评估防御方案
- 多数防御在自适应攻击下失效，且影响模型基础能力
- 为未来防御设计提供可复现的评估基准
大型语言模型易受提示注入攻击，尽管已有多种防御方法被提出并宣称有效，但现有研究缺乏严谨的评估方法。本文主张从两个关键维度评估防御：(1) 有效性，需在多样化的已有及自适应攻击（含不同目标与注入提示）下验证；(2) 通用实用性，确保不损害LLM的基础功能。我们的批判性评估表明，以往研究未采用此类全面方法。在新标准下重新评估后，发现多数现有防御的实际效果远低于此前报告。本工作为未来防御的评估与开发提供了坚实基础。代码与数据已公开于：https://github.com/PIEval123/PIEval。
原文摘要 · Abstract (English)
Large Language Models (LLMs) are vulnerable to prompt injection attacks, and several defenses have recently been proposed, often claiming to mitigate these attacks successfully. However, we argue that existing studies lack a principled approach to evaluating these defenses. In this paper, we argue the need to assess defenses across two critical dimensions: (1) effectiveness, measured against both existing and adaptive prompt injection attacks involving diverse target and injected prompts, and (2) general-purpose utility, ensuring that the defense does not compromise the foundational capabilities of the LLM. Our critical evaluation reveals that prior studies have not followed such a comprehensive evaluation methodology. When assessed using this principled approach, we show that existing defenses are not as successful as previously reported. This work provides a foundation for evaluating future defenses and guiding their development. Our code and data are available at: https://github.com/PIEval123/PIEval.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。