针对MCP系统提示注入攻击，提出三级本地防御架构CASCADE。
CASCADE: A Cascaded Hybrid Defense Architecture for Prompt Injection Detection in MCP-Based Systems
- 三级级联检测：规则过滤、嵌入语义分析、模式输出筛选
- 95.85%精确率，6.06%误报率，对数据泄露检测率达91.5%
- 无需外部API，全本地运行，适合隐私敏感场景
模型上下文协议（MCP）是定义和调用LLM应用中外部工具的快速采用标准。MCP的多层架构引入了工具污染等新型攻击面，除了传统的提示注入攻击。现有防御系统存在高误报率、依赖API或需白盒访问等局限。本研究提出CASCADE，一种三阶段级联防御架构：(i) 第一层通过正则表达式、短语加权和熵分析进行快速预过滤；(ii) 第二层利用BGE嵌入进行语义分析，并配备Ollama Llama3回退机制；(iii) 第三层实施基于模式的输出过滤。在5,000个样本的数据集上评估显示，精确率为95.85%，误报率为6.06%，召回率为61.05%，F1得分为74.59%。对31种攻击类型按6类分类分析表明，数据外泄（91.5%）和提示注入（84.2%）检测率较高，而语义攻击（52.5%）和工具污染（59.9%）仍有提升空间。CASCADE的核心优势在于完全本地化运行，无需外部API调用。
原文摘要 · Abstract (English)
Model Context Protocol (MCP) is a rapidly adopted standard for defining and invoking external tools in LLM applications. The multi-layered architecture of MCP introduces new attack surfaces such as tool poisoning, in addition to traditional prompt injection. Existing defense systems suffer from limitations including high false positive rates, API dependency, or white-box access requirements. In this study, we propose CASCADE, a three-tiered cascaded defense architecture for MCP-based systems: (i) Layer 1 performs fast pre-filtering using regex, phrase weighting, and entropy analysis; (ii) Layer 2 conducts semantic analysis via BGE embedding with an Ollama Llama3 fallback mechanism; (iii) Layer 3 applies pattern-based output filtering. Evaluation on a dataset of 5,000 samples yielded 95.85% precision, 6.06% false positive rate, 61.05% recall, and 74.59% F1-score. Analysis across 31 attack types categorized into 6 tiers revealed high detection rates for data exfiltration (91.5%) and prompt injection (84.2%), while semantic attack (52.5%) and tool poisoning (59.9%) categories showed potential for improvement. A key advantage of CASCADE over existing solutions is its fully local operation, requiring no external API calls
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。