通过语义覆盖隐藏有效工具，让大模型代理无法找到正确工具。
ToolFlood: Beyond Selection -- Hiding Valid Tools from LLM Agents via Semantic Covering
- 用精心设计的虚假工具填满嵌入空间，干扰检索结果。
- 在ToolBench上仅用1%注入率即达95%攻击成功率。
- 适合研究模型鲁棒性或对抗攻击的安全研究人员。
大型语言模型（LLM）代理越来越多地依赖外部工具完成复杂任务，并通过基于嵌入的检索选择少量顶级工具进行推理。随着系统规模扩大，这一检索阶段的鲁棒性尚未被充分探索，尽管已有研究关注工具选择的攻击。本文提出ToolFlood，一种针对工具增强型LLM代理的检索层攻击。不同于改变检索后选择的工具，ToolFlood通过注入少数由攻击者控制、其元数据经嵌入空间几何精心构造的工具，使检索过程饱和。这些工具在语义上覆盖大量用户查询，占据前k个结果，将所有良性工具挤出代理上下文。ToolFlood采用两阶段对抗工具生成策略：首先采样目标查询子集，利用LLM迭代生成多样化的工具名称与描述；随后运行迭代贪心选择，在余弦距离阈值下最大化剩余查询的覆盖范围，直至所有查询被覆盖或达到预算。我们提供了检索饱和的理论分析，并在标准基准上验证，ToolFlood在ToolBench上以1%的注入率实现高达95%的攻击成功率。代码将公开于：https://github.com/as1-prog/ToolFlood。
原文摘要 · Abstract (English)
Large Language Model (LLM) agents increasingly use external tools for complex tasks and rely on embedding-based retrieval to select a small top-k subset for reasoning. As these systems scale, the robustness of this retrieval stage is underexplored, even though prior work has examined attacks on tool selection. This paper introduces ToolFlood, a retrieval-layer attack on tool-augmented LLM agents. Rather than altering which tool is chosen after retrieval, ToolFlood overwhelms retrieval itself by injecting a few attacker-controlled tools whose metadata is carefully placed by exploiting the geometry of embedding space. These tools semantically span many user queries, dominate the top-k results, and push all benign tools out of the agent's context. ToolFlood uses a two-phase adversarial tool generation strategy. It first samples subsets of target queries and uses an LLM to iteratively generate diverse tool names and descriptions. It then runs an iterative greedy selection that chooses tools maximizing coverage of remaining queries in embedding space under a cosine-distance threshold, stopping when all queries are covered or a budget is reached. We provide theoretical analysis of retrieval saturation and show on standard benchmarks that ToolFlood achieves up to a 95% attack success rate with a low injection rate (1% in ToolBench). The code will be made publicly available at the following link: https://github.com/as1-prog/ToolFlood
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。