提出新型评分公式，精准识别多轮提示注入攻击。
Peak + Accumulation: A Proxy-Level Scoring Formula for Multi-Turn LLM Attack Detection
- 融合峰值风险与持续性，避免传统平均法失效。
- 在10,654条对话中实现90.8%召回率，误报率仅1.20%。
- 适合安全防护系统快速部署，开源可复用。
多轮提示注入攻击将恶意意图分散于多个对话回合，利用每轮独立评估的假设。尽管单轮检测已有广泛研究，但尚无公开公式能在不调用大模型的前提下，将每轮模式得分聚合为对话级风险分。我们发现直观的加权平均方法存在根本缺陷：无论回合数多少，最终得分均趋近于单轮分数，导致20轮持续攻击与单轮可疑行为评分相同。借鉴变化点检测（CUSUM）、贝叶斯信念更新和安全告警机制，提出峰值+累积评分公式，结合单轮最高风险、持续比例和类别多样性。在10,654条多轮对话上评估，包含588个来自WildJailbreak的攻击样本和10,066条来自WildChat的良性对话，该公式实现90.8%召回率、1.20%误报率，F1达85.9%。对持续参数的敏感性分析显示，在rho ~ 0.4处出现相变，召回率跃升12个百分点，误报率几乎不变。算法、模式库和评估工具已开源。
原文摘要 · Abstract (English)
Multi-turn prompt injection attacks distribute malicious intent across multiple conversation turns, exploiting the assumption that each turn is evaluated independently. While single-turn detection has been extensively studied, no published formula exists for aggregating per-turn pattern scores into a conversation-level risk score at the proxy layer -- without invoking an LLM. We identify a fundamental flaw in the intuitive weighted-average approach: it converges to the per-turn score regardless of turn count, meaning a 20-turn persistent attack scores identically to a single suspicious turn. Drawing on analogies from change-point detection (CUSUM), Bayesian belief updating, and security risk-based alerting, we propose peak + accumulation scoring -- a formula combining peak single-turn risk, persistence ratio, and category diversity. Evaluated on 10,654 multi-turn conversations -- 588 attacks sourced from WildJailbreak adversarial prompts and 10,066 benign conversations from WildChat -- the formula achieves 90.8% recall at 1.20% false positive rate with an F1 of 85.9%. A sensitivity analysis over the persistence parameter reveals a phase transition at rho ~ 0.4, where recall jumps 12 percentage points with negligible FPR increase. We release the scoring algorithm, pattern library, and evaluation harness as open source.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。