提出新型提示攻击，绕过生产环境中的AI安全过滤机制。
Bypassing Prompt Guards in Production with Controlled-Release Prompting
- 利用输入过滤器与主模型的资源差异，生成过滤器无法识别但模型可处理的恶意提示。
- 在谷歌Gemini等四大主流聊天平台成功绕过防护，且传统方法失效。
- 适用于研究安全漏洞或对抗样本的开发者，揭示现有防护机制的根本缺陷。
Ball等人最近证明，在标准密码学假设下，任何运行速度显著快于目标模型的提示过滤器，都无法普遍区分恶意提示与良性提示。我们探讨这一不可能性结果是否转化为实际部署的大语言模型系统中的漏洞。通过引入可控释放提示（controlled-release prompting），我们以实用方式实现了该理论框架，利用轻量级输入过滤器与主模型之间的资源不对称性。该攻击无需修改模型即可生成对任何有界过滤器不可读、但对目标LLM仍可处理的恶意提示。实验表明，该攻击在谷歌Gemini、DeepSeek Chat、xAI Grok和Mistral Le Chat四个主要聊天平台均成功绕过防护，而基线方法均失败。此外，我们成功从Gemini中提取受版权保护的数据。最后，我们系统评估了14个开源权重的提示防护模型，发现即使具备推理能力的过滤器也无法在不产生极高的资源开销的前提下可靠检测本攻击。
原文摘要 · Abstract (English)
Ball et al. recently established that prompt filtering for AI alignment faces a fundamental barrier: under standard cryptographic assumptions, no filter running significantly faster than the protected model can universally distinguish adversarial prompts from benign ones. We investigate whether this impossibility result translates to real-world vulnerabilities in deployed large language model (LLM) systems. We answer affirmatively by introducing controlled-release prompting, a practical instantiation of the theoretical framework that exploits the resource asymmetry between lightweight input filters and the main models they protect. Unlike the theoretical construction, our attack does not require model modification: it generates malicious prompts that are indecipherable by any bounded filter yet remain tractable to the target LLM. We find our attack to be successful on four major chat platforms (Google Gemini, DeepSeek Chat, xAI Grok, and Mistral Le Chat) where baseline methods fail. Additionally, we apply our attack to extract copyrighted data from Gemini. Finally, we provide a systematic evaluation of 14 open-weight prompt guard models, revealing that even reasoning-capable filters cannot reliably detect our attack without incurring prohibitive resource overhead.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。