通过分权双代理结构阻断提示注入攻击，实现零成功率防御。
Agent Privilege Separation in OpenClaw: A Structural Defense Against Prompt Injection
- 采用分权双代理架构，工具与执行代理隔离，切断攻击路径。
- 全系统防御在649次攻击中实现0%成功率，较基线提升323倍。
- 结构化输出可剥离诱导性话术，适合高安全需求的AI应用。
提示注入仍是当前大模型集成应用中最实用的攻击方式之一。我们在开源多工具代理平台OpenClaw中复现了Microsoft LLMail-Inject基准测试（Greshake et al., 2024），针对当前一代模型进行评估。所提防御结合两种机制：代理隔离，即通过权限分离的双代理流水线与工具分区实现；以及JSON格式化，生成结构化输出，在行动代理处理前剥离诱导性表述。在相同的649次成功攻击中，完整管道实现0%攻击成功率（ASR），较单代理基线下降323倍；仅代理隔离即达0.31% ASR，为基线的1/323；仅使用JSON格式化则为14.18% ASR，降低约7.1倍。消融实验表明，代理隔离是主导机制，格式化提供额外防护但不可独立生效。该防御为结构性设计，行动代理始终无法接收到原始注入内容，不依赖模型对特定输入的行为表现。
原文摘要 · Abstract (English)
Prompt injection remains one of the most practical attack vectors against LLM-integrated applications. We replicate the Microsoft LLMail-Inject benchmark (Greshake et al., 2024) against current generation models running inside OpenClaw, an open source multitool agent platform. Our proposed defense combines two mechanisms: agent isolation, implemented as a privilege separated two-agent pipeline with tool partitioning, and JSON formatting, which produces structured output that strips persuasive framing before the action agent processes it. We run four experiments on the same 649 attacks that succeeded against our single-agent baseline. The full pipeline achieves 0 percent attack success rate (ASR) on the evaluated benchmark. Agent isolation alone achieves 0.31 percent ASR, approximately 323 times lower than the baseline. JSON formatting alone achieves 14.18 percent ASR, about 7.1 times lower. Our ablation study confirms that agent isolation is the dominant mechanism. JSON formatting provides additional hardening but is not sufficient on its own. The defense is structural: the action agent never receives raw injection content regardless of model behavior on any individual input.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。