用注意力机制攻击暴露微调防御漏洞，成功率高达95%。
May I have your Attention? Breaking Fine-Tuning based Prompt Injection Defenses using Architecture-Aware Attacks
- 设计基于注意力的优化攻击，精准绕过微调防护
- 在未见提示上实现85%-95%攻击成功率
- 适合安全研究者和模型防御开发者参考
针对大语言模型（LLM）提示注入攻击的一种主流防御方法是通过微调将指令与数据分离，以防止模型执行隐藏在数据中的指令。本文在白盒设置下评估该方法的鲁棒性，提出一种新型基于注意力的优化攻击算法，并应用于三种近期白盒防御方案：SecAlign（CCS 2025）、SecAlign++ 和 StruQ（USENIX Security 2025）。实验表明，该攻击在未见过的提示上成功率达85%-95%，且仅需小幅增加令牌预算。结果揭示了现有微调防御在白盒场景下的根本性缺陷，推动了对提示注入防御鲁棒性的深入理解。代码与攻击工具已开源于 https://github.com/nishitvp/better_opts_attacks。
原文摘要 · Abstract (English)
A popular class of defenses against prompt injection attacks on large language models (LLMs) relies on fine-tuning to separate instructions and data, so that the LLM does not follow instructions that might be present with data. We evaluate the robustness of this approach in the whitebox setting by constructing strong optimization-based attacks, and show that the defenses do not provide the claimed security properties. Specifically, we construct a novel attention-based attack algorithm for textual LLMs and apply it to three recent whitebox defenses SecAlign (CCS 2025), SecAlign++, and StruQ (USENIX Security 2025), showing attacks with success rates of up to \textbf{85-95\%} on unseen prompts with modest increase in attacker budget in terms of tokens. Our findings make fundamental progress towards understanding the robustness of prompt injection defenses in the whitebox setting. We release our code and attacks at https://github.com/nishitvp/better_opts_attacks
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。