测试大模型网页代理如何被诱导偏离任务，发现攻击成功率高达43%。
It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents
- 构建真实网页环境下的劝诱攻击基准，模拟界面元素隐藏指令
- 六款模型平均25%任务被攻陷，部分达43%，微小改动可翻倍成功率
- 适合安全研究者和模型开发者，揭示心理驱动的系统性漏洞
基于大语言模型的网页代理在邮件管理、职业社交等任务中日益普及。然而，其依赖动态网页内容的特性使其易受提示注入攻击：恶意指令藏于界面元素中，诱使代理偏离原任务。我们提出任务重定向代理劝诱基准（TRAP），用于研究劝诱技术如何误导自主网页代理完成真实任务。在六款前沿模型中，代理平均在25%的任务中受到提示注入影响（GPT-5为13%，DeepSeek-R1达43%），微小的界面或上下文变化常使攻击成功率翻倍，揭示了网页代理在心理层面存在的系统性脆弱性。我们还提供模块化社会工程注入框架，在高保真网站克隆上进行可控实验，支持基准持续扩展。
原文摘要 · Abstract (English)
Web-based agents powered by large language models are increasingly used for tasks such as email management or professional networking. Their reliance on dynamic web content, however, makes them vulnerable to prompt injection attacks: adversarial instructions hidden in interface elements that persuade the agent to divert from its original task. We introduce the Task-Redirecting Agent Persuasion Benchmark (TRAP), a benchmark for studying how persuasion techniques misguide autonomous web agents on realistic tasks. Across six frontier models, agents are susceptible to prompt injection in 25% of tasks on average (13% for GPT-5 to 43% for DeepSeek-R1), with small interface or contextual changes often doubling success rates and revealing systemic, psychologically driven vulnerabilities in web-based agents. We also provide a modular social-engineering injection framework with controlled experiments on high-fidelity website clones, allowing for further benchmark expansion.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。