用类型化权限隔离防止提示注入攻击，提升智能体安全性。
Preventing Prompt Injection with Type-Directed Privilege Separation
- 将不可信数据转为受限数据类型，切断攻击路径。
- 多案例验证显示可完全阻止提示注入，同时保持实用功能。
- 方法简单易懂，适配任何语言模型，适合安全敏感场景。
现代语言模型推动了智能体系统的发展，使其在复杂推理任务中表现优异。然而，这也带来了安全风险：这些系统易受提示注入攻击，攻击者可通过注入任务篡改智能体行为。已有方法依赖检测器或微调防御，但易被自适应攻击绕过；另一些系统级防御虽能保证安全，却常因禁止组件间通信而限制适用范围。为此，本文提出类型导向的权限分离技术，通过将不可信数据转化为受控的数据类型，使每类数据的范围和内容受限，从而消除提示注入的可能性。我们在多个案例研究中评估该方法，结果表明，遵循此原则的设计能系统性地抵御提示注入攻击，同时具备强大且非平凡的实用性。该方法直观易懂，兼容任意语言模型。
原文摘要 · Abstract (English)
Modern language models have enabled the development of agentic systems that achieve strong performance on reasoning-intensive tasks. Unfortunately, this has come with a security cost; these systems are vulnerable to prompt injection, a specialized attack where an adversary subverts the intended functionality of an agent by supplying an injected task of their own. Previous approaches address this challenge with detectors and fine-tuning defenses but are vulnerable to adaptive attacks. Other methods propose system-level defenses that guarantee security, but these are often based on techniques that prevent inter-component communication and thus are constrained in problem coverage. To this end, we introduce type-directed privilege separation, a new technique that expands the set of tasks that can be protected with system-level defenses. Our method works by converting untrusted data to a curated set of data types; unlike raw strings, each data type is limited in scope and content, eliminating the possibility for prompt injection. We evaluate our method across several case studies and find that designs using our principles can systematically prevent prompt injection attacks while featuring strong, non-trivial utility. Our approach is intuitive to understand and compatible with any language model.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。