通过追踪攻击链四阶段，揭示大模型系统在不同环节的注入漏洞。
Kill-Chain Canaries: Stage-Level Tracking of Prompt Injection Across Attack Surfaces and Model Safety Tiers
- 设计攻击链监控框架，追踪令牌从暴露到执行的四个阶段。
- 发现写入节点位置是最高杠杆安全决策，可阻断传播路径。
- 白底黑字文档攻击效果与可见文本相当，渲染层检测无效。
多智能体大模型系统正进入生产环境，处理文档、管理流程、代用户行动，但其对提示注入的韧性仍仅以成功与否二元判断，缺乏诊断信息。本文提出杀伤链蜜罐方法，追踪加密令牌在950次实验、五款前沿大模型、六类攻击面和五种防御条件下的四个阶段（暴露→留存→传递→执行）。结果将提示注入重定义为系统架构问题：所有模型均完全暴露，但下游结果分化显著——Claude在内存写入阶段阻断所有注入（ASR=0/164），GPT-4o-mini传播率达53%，DeepSeek在相同模型下各攻击面表现差异达0%/100%。三个部署关键发现：(1) 写入节点位置是最高杠杆安全决策——通过可信模型路由写入可彻底阻断传播；(2) 所有四种防御在至少一个攻击面上失效，仅因通道错配，无需对抗适应；(3) 无形白底黑字PDF载荷的攻击成功率与可见文本相当或更高，说明渲染层筛查不足。这些动态直接适用于生产场景：机构投资者与金融机构已将自然语言处理流水线用于财报电话会、美国证监会文件及分析师报告——如今正迁移至大模型代理工作流。代码、运行日志与工具已公开。
原文摘要 · Abstract (English)
Multi-agent LLM systems are entering production -- processing documents, managing workflows, acting on behalf of users -- yet their resilience to prompt injection is still evaluated with a single binary: did the attack succeed? This leaves architects without the diagnostic information needed to harden real pipelines. We introduce a kill-chain canary methodology that tracks a cryptographic token through four stages (EXPOSED -> PERSISTED -> RELAYED -> EXECUTED) across 950 runs, five frontier LLMs, six attack surfaces, and five defense conditions. The results reframe prompt injection as a pipeline-architecture problem: every model is fully exposed, yet outcomes diverge downstream -- Claude blocks all injections at memory-write (0/164 ASR), GPT-4o-mini propagates at 53%, and DeepSeek exhibits 0%/100% across surfaces from the same model. Three findings matter for deployment: (1) write-node placement is the highest-leverage safety decision -- routing writes through a verified model eliminates propagation; (2) all four defenses fail on at least one surface due to channel mismatch alone, no adversarial adaptation required; (3) invisible whitefont PDF payloads match or exceed visible-text ASR, meaning rendered-layer screening is insufficient. These dynamics apply directly to production: institutional investors and financial firms already run NLP pipelines over earnings calls, SEC filings, and analyst reports -- the document-ingestion workflows now migrating to LLM agents. Code, run logs, and tooling are publicly released.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。