用七种跨领域方法提升提示注入检测，避免传统方法的漏洞。
Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection
- 引入法医语言学、材料疲劳分析等七种外部学科机制，独立于传统检测方式。
- 在九个基准上测试，组合使用时检测准确率恢复至0.815 F1，单个方法失效时仍有效。
- 已集成到prompt-shield v0.7.3，适合安全研究者和模型部署团队使用。
当前开源提示注入检测器主要依赖正则匹配和微调的Transformer分类器，二者均存在明显缺陷：正则无法识别改写攻击，微调模型易受自适应攻击突破。2025年NAACL Findings研究显示，八种已有间接注入防御在自适应攻击下成功率超50%。本文提出七种跨领域检测技术，分别源自法医语言学、材料科学疲劳分析、欺骗技术、生物信息学局部序列对齐、机制设计、谱信号分析与污点追踪。每种方法生成的信号在架构上独立于正则与Transformer，可与现有防御组合而非替代。其中四种已实现于prompt-shield v0.7.3（Apache 2.0）：d028序列对齐、d027风格突变检测、材料疲劳追踪及d034蜜罐工具定义（v4.0新增）。在九个基准（约10,300样本）上的四配置消融实验覆盖deepset、NotInject、LLMail-Inject、AgentHarm、AgentDojo，以及三项同行评审学术基准（Liu USENIX 2024、Garak、InjecAgent）。修订版新增第5.7节（组合式对抗攻击部分运行，支持组合性论点）、第5.8节（50文档保留基准：d027孤立时F1从1.000降至0.000，组合引擎恢复至0.815），以及第7节（从prompt-shield中提取三种架构模式，以四人组形式呈现）。所有代码、数据与复现脚本均已开源（Apache 2.0）。
原文摘要 · Abstract (English)
Current open-source prompt-injection detectors converge on two architectural choices: regular-expression pattern matching and fine-tuned transformer classifiers. Both share failure modes recent work has made concrete. Regular expressions miss paraphrased attacks. Fine-tuned classifiers are vulnerable to adaptive adversaries: a 2025 NAACL Findings study reported that eight published indirect-injection defenses were bypassed with greater than fifty percent attack-success rates under adaptive attacks. This work proposes seven detection techniques that each port a mechanism from a discipline outside LLM security: forensic linguistics, materials-science fatigue analysis, deception technology, local-sequence alignment from bioinformatics, mechanism design, spectral signal analysis, and taint tracking. Each produces a signal architecturally independent of both regex matching and transformer classification, so the seven compose with existing defenses rather than replacing them. Four of seven are now implemented in prompt-shield v0.7.3 (Apache 2.0): d028 sequence alignment, d027 stylometric discontinuity, materials-fatigue tracking, and d034 honeypot tool definitions (new in v4.0). A four-configuration ablation across nine benchmarks (~10,300 samples) covers deepset, NotInject, LLMail-Inject, AgentHarm, AgentDojo, and an independent evaluation against three peer-reviewed academic benchmarks (Liu USENIX 2024, Garak, InjecAgent). This revision adds Section 5.7 (composed-stack adaptive-attack partial run, evidence for the composability thesis), Section 5.8 (50-document held-out benchmark: d027 collapses 1.000 to 0.000 F1 in isolation but the composed engine recovers 0.815 F1), and Section 7 (three architectural patterns extracted from prompt-shield in Gang-of-Four format). All code, data, and reproduction scripts are released Apache 2.0.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。