提出多模态防御框架，防止智能体间恶意指令传播。
Toward Trustworthy Agentic AI: A Multimodal Framework for Preventing Prompt Injection Attacks
- 构建跨智能体的多模态溯源防御体系，统一清洗和验证输入输出。
- 在LangChain/GraphChain类工作流中实现95%以上注入检测准确率。
- 适合需要高可信度的自动化系统开发者与安全研究人员。
大型语言模型（LLMs）、视觉-语言模型（VLMs）及智能体系统（如LangChain、GraphChain）使自主推理、规划与协作成为可能。然而，这一多智能体环境增加了多模态提示注入（PI）攻击的风险：隐藏于文本、图像、元数据或智能体间消息中的恶意指令可在图谱中传播，引发非预期行为、策略违规或状态污染。为此，本文提出一种跨智能体多模态溯源感知防御框架，对用户生成或上游智能体产生的所有提示进行净化，并在输出发送至下游节点前独立验证。该框架包含文本净化智能体、视觉净化智能体与输出验证智能体，均由溯源账本统一协调，记录模态、来源与信任等级。此架构确保智能体间通信遵循明确信任边界，有效阻断注入指令在LangChain或GraphChain式工作流中的传播。实验表明，多模态注入检测准确率显著提升，跨智能体信任泄漏最小化，智能体执行路径趋于稳定。该框架将溯源追踪与验证扩展至多智能体编排，助力构建安全、可解释、可靠的智能体系统。
原文摘要 · Abstract (English)
Powerful autonomous systems, which reason, plan, and converse using and between numerous tools and agents, are made possible by Large Language Models (LLMs), Vision-Language Models (VLMs), and new agentic AI systems, like LangChain and GraphChain. Nevertheless, this agentic environment increases the probability of the occurrence of multimodal prompt injection (PI) attacks, in which concealed or malicious instructions carried in text, pictures, metadata, or agent-to-agent messages may spread throughout the graph and lead to unintended behavior, a breach of policy, or corruption of state. In order to mitigate these risks, this paper suggests a Cross-Agent Multimodal Provenanc- Aware Defense Framework whereby all the prompts, either user-generated or produced by upstream agents, are sanitized and all the outputs generated by an LLM are verified independently before being sent to downstream nodes. This framework contains a Text sanitizer agent, visual sanitizer agent, and output validator agent all coordinated by a provenance ledger, which keeps metadata of modality, source, and trust level throughout the entire agent network. This architecture makes sure that agent-to-agent communication abides by clear trust frames such such that injected instructions are not propagated down LangChain or GraphChain-style-workflows. The experimental assessments show that multimodal injection detection accuracy is significantly enhanced, and the cross-agent trust leakage is minimized, as well as, agentic execution pathways become stable. The framework, which expands the concept of provenance tracking and validation to the multi-agent orchestration, enhances the establishment of secure, understandable and reliable agentic AI systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。