提出VIGIL框架，用先验证后执行机制防御大模型工具流注入攻击。
VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commit
- 采用先验证后提交的协议，动态保持推理灵活性。
- 在959个攻击案例中，成功率降低超22%，效率翻倍于静态防御。
- 适合关注AI安全与实用性的研究人员和工程师。
在开放环境中运行的大语言模型代理面临日益严重的间接提示注入威胁，尤其在工具流中，被篡改的元数据和运行时反馈会劫持执行流程。现有防御方法陷入两难：先进模型因严格对齐而优先执行注入规则，而静态保护机制又切断了自适应推理所需的反馈回路。为此，我们提出VIGIL框架，将范式从限制性隔离转向先验证后提交。通过支持推测性假设生成，并以意图为基础进行安全验证，VIGIL在保持推理灵活性的同时确保强控制。我们还构建了SIREN基准，包含959个工具流注入案例，模拟具有动态依赖性的普遍威胁。大量实验表明，相较于最先进动态防御，VIGIL将攻击成功率降低超过22%，且在攻击下实用性比静态基线提升一倍以上，实现了安全与效用的最优平衡。
原文摘要 · Abstract (English)
LLM agents operating in open environments face escalating risks from indirect prompt injection, particularly within the tool stream where manipulated metadata and runtime feedback hijack execution flow. Existing defenses encounter a critical dilemma as advanced models prioritize injected rules due to strict alignment while static protection mechanisms sever the feedback loop required for adaptive reasoning. To reconcile this conflict, we propose \textbf{VIGIL}, a framework that shifts the paradigm from restrictive isolation to a verify-before-commit protocol. By facilitating speculative hypothesis generation and enforcing safety through intent-grounded verification, \textbf{VIGIL} preserves reasoning flexibility while ensuring robust control. We further introduce \textbf{SIREN}, a benchmark comprising 959 tool stream injection cases designed to simulate pervasive threats characterized by dynamic dependencies. Extensive experiments demonstrate that \textbf{VIGIL} outperforms state-of-the-art dynamic defenses by reducing the attack success rate by over 22\% while more than doubling the utility under attack compared to static baselines, thereby achieving an optimal balance between security and utility.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。