用激活值引导的采样方法，让提示注入攻击跨模型更有效。
Transferable Direct Prompt Injection via Activation-Guided MCMC Sampling
- 基于代理模型激活值构建能量模型，指导生成对抗性提示。
- 在五款主流大模型上实现49.6%攻击成功率，比人工提示高34.6%。
- 无需梯度信息，适用于黑盒攻击，适合安全评估与防御研究者。
直接提示注入（DPI）攻击因实施门槛低且破坏力强，对大语言模型构成严重安全威胁。现有白盒/灰盒方法不切实际，黑盒方法转移能力差。本文提出一种基于激活值引导的提示注入攻击框架：首先利用代理模型的激活值构建能量模型（EBM），评估对抗性提示质量；再通过分词级马尔可夫链蒙特卡洛（MCMC）采样，在无梯度条件下自适应优化提示，实现免梯度黑盒攻击。实验表明，该方法在五款主流大模型上达到49.6%的攻击成功率，较人工设计提示提升34.6%，在未见任务场景下仍保持36.6%的攻击成功率。可解释性分析揭示激活值与攻击效果存在相关性，凸显语义模式在可转移漏洞利用中的关键作用。
原文摘要 · Abstract (English)
Direct Prompt Injection (DPI) attacks pose a critical security threat to Large Language Models (LLMs) due to their low barrier of execution and high potential damage. To address the impracticality of existing white-box/gray-box methods and the poor transferability of black-box methods, we propose an activations-guided prompt injection attack framework. We first construct an Energy-based Model (EBM) using activations from a surrogate model to evaluate the quality of adversarial prompts. Guided by the trained EBM, we employ the token-level Markov Chain Monte Carlo (MCMC) sampling to adaptively optimize adversarial prompts, thereby enabling gradient-free black-box attacks. Experimental results demonstrate our superior cross-model transferability, achieving 49.6% attack success rate (ASR) across five mainstream LLMs and 34.6% improvement over human-crafted prompts, and maintaining 36.6% ASR on unseen task scenarios. Interpretability analysis reveals a correlation between activations and attack effectiveness, highlighting the critical role of semantic patterns in transferable vulnerability exploitation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。