发现大模型技能中毒的内部信号，提出新检测方法提升防御效果
RouteGuard: Internal-Signal Detection of Skill Poisoning in LLM Agents
- 通过分析注意力劫持机制识别恶意技能
- 在真实与合成数据上实现0.8834的F1分数
- 适合需要高安全性的智能体系统开发者
代理技能为大模型代理引入了一种更严重的间接注入攻击：攻击者可将恶意指令隐藏于密集、以动作为导向的技能中，该技能本身已是合法指令来源。我们研究了执行前的技能中毒检测，发现成功中毒会引发结构化内部效应——注意力劫持，即响应时间的注意力从可信上下文转移到恶意技能片段，从而驱动有害行为。基于此机制，我们提出RouteGuard，一种冻结主干的检测器，结合响应条件注意力与隐藏状态对齐，通过可靠性门控的晚期融合。在真实与合成的开源技能基准上，RouteGuard始终表现最强或最稳健；在关键的Skill-Inject通道切片中，其F1达0.8834，比词汇筛选法多恢复90.51%被遗漏的描述型攻击，表明防御技能中毒需依赖内部信号检测而非仅文本过滤。
原文摘要 · Abstract (English)
Agent skills introduce a new and more severe form of indirect injection for LLM agents: unlike traditional indirect prompt injection, attackers can hide malicious instructions inside a dense, action-oriented skill that already functions as a legitimate instruction source. We study pre-execution skill-poison detection and show that successful skill poisoning induces a structured internal effect, attention hijacking, in which response-time attention shifts from trusted context to malicious skill spans and drives harmful behavior. Motivated by this mechanism, we propose RouteGuard, a frozen-backbone detector that combines response-conditioned attention and hidden-state alignment through reliability-gated late fusion. Across both real and synthetic open-source skill benchmarks, RouteGuard is consistently the strongest or most robust detector; on the critical Skill-Inject channel slice, it reaches 0.8834 F1 and recovers 90.51% of description attacks missed by lexical screening, showing that defending against skill poisoning requires internal-signal detection rather than text-only filtering
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。