首个定位提示注入攻击位置的方法，助力事后分析与数据恢复。
PromptLocate: Localizing Prompt Injection Attacks
- 将污染数据切分为语义连贯片段，逐段检测是否含注入指令或数据
- 在8种现有攻击和8种自适应攻击下均实现精准定位
- 适合安全研究人员、模型运维人员用于防御后分析
提示注入攻击通过在输入数据中嵌入恶意指令，诱使大语言模型执行攻击者指定任务而非原定任务。定位污染数据中的注入提示对事后分析和数据恢复至关重要。尽管重要性日益凸显，提示注入定位仍鲜有研究。本文提出PromptLocate，首个实现注入提示定位的方法。该方法包含三步：(1) 将污染数据分割为语义连贯的片段；(2) 识别含注入指令的片段；(3) 精确定位含注入数据的片段。实验表明，PromptLocate在八种现有攻击和八种自适应攻击下均能准确完成定位。
原文摘要 · Abstract (English)
Prompt injection attacks deceive a large language model into completing an attacker-specified task instead of its intended task by contaminating its input data with an injected prompt, which consists of injected instruction(s) and data. Localizing the injected prompt within contaminated data is crucial for post-attack forensic analysis and data recovery. Despite its growing importance, prompt injection localization remains largely unexplored. In this work, we bridge this gap by proposing PromptLocate, the first method for localizing injected prompts. PromptLocate comprises three steps: (1) splitting the contaminated data into semantically coherent segments, (2) identifying segments contaminated by injected instructions, and (3) pinpointing segments contaminated by injected data. We show PromptLocate accurately localizes injected prompts across eight existing and eight adaptive attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。