用大模型自动识别并清除恶意注入提示，防御成功率超99%。
PromptArmor: Simple yet Effective Prompt Injection Defenses
- 让现成大模型先检测并删除输入中的恶意提示。
- 在AgentDojo上误报率与漏报率均低于1%。
- 可抵御自适应攻击，适合安全防护研究者使用。
尽管大语言模型（LLM）具有潜力，但近期研究显示其代理系统易受提示注入攻击，攻击者通过注入恶意提示使代理执行非预期任务。本文提出PromptArmor，一种简单有效的防御方法：利用现成的LLM在代理处理前检测并移除潜在注入提示。实验表明，采用GPT-4o、GPT-4.1或o4-mini时，PromptArmor在AgentDojo基准测试中实现低于1%的误报率和漏报率；移除注入提示后，攻击成功率降至1%以下。同时验证了其对自适应攻击的鲁棒性，并探索了不同提示策略。建议将PromptArmor作为评估新防御方法的标准基线。
原文摘要 · Abstract (English)
Despite their potential, recent research has demonstrated that LLM agents are vulnerable to prompt injection attacks, where malicious prompts are injected into the agent's input, causing it to perform an attacker-specified task rather than the intended task provided by the user. In this paper, we present PromptArmor, a simple yet effective defense against prompt injection attacks. Specifically, PromptArmor prompts an off-the-shelf LLM to detect and remove potential injected prompts from the input before the agent processes it. Our results show that PromptArmor can accurately identify and remove injected prompts. For example, using GPT-4o, GPT-4.1, or o4-mini, PromptArmor achieves both a false positive rate and a false negative rate below 1% on the AgentDojo benchmark. Moreover, after removing injected prompts with PromptArmor, the attack success rate drops to below 1%. We also demonstrate PromptArmor's effectiveness against adaptive attacks and explore different strategies for prompting an LLM. We recommend that PromptArmor be adopted as a standard baseline for evaluating new defenses against prompt injection attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。