多语言提示注入攻击防御框架，融合大模型与词频特征提升鲁棒性
MIPIAD: Multilingual Indirect Prompt Injection Attack Defense with Qwen -- TF-IDF Hybrid and Meta-Ensemble Learning
- 用微调的Qwen模型结合TF-IDF词频特征，构建混合检测器
- 在143万样本上实现0.9205的最高F1和0.9378的AUROC
- 跨语言性能优于单一模型，支持扩展至200多种语言
间接提示注入仍是检索增强与工具使用型大模型系统的持续弱点，尤其在多语言环境下更难识别。本文提出MIPIAD防御框架，在英语和孟加拉语上进行评估，结合从Qwen2.5-1.5B微调得到的序列分类器（XLPID）、TF-IDF词频特征，以及通过后期融合、堆叠和梯度提升进行验证调优的集成方法。该框架在基于BIPIA（Yi等, 2023）模板构建的合成基准上测试，涵盖邮件、表格、问答、摘要和代码五大任务类型，共生成超过143万条样本，训练与测试集使用互斥的攻击类别。实验表明，词频信号表现强劲（TF-IDF+SVM F1=0.77），混合XLPID+TF-IDF集成达到最优总体F1（0.9205），而梯度提升集成在AUROC上最佳（0.9378）。集成方法显著缩小了英-孟加拉语间的跨语言差距。该流程设计可扩展：NLLB-200支持超过200种语言，且XLPID的多语言骨干无需架构改动即可适配新语言；当前实证验证仅限于英语和孟加拉语。
原文摘要 · Abstract (English)
Indirect prompt injection remains a persistent weakness in retrieval-augmented and tool-using LLM systems, and the problem becomes harder to characterise in multilingual settings. We present MIPIAD, a defense framework evaluated on English and Bangla that combines a sequence classifier fine-tuned from Qwen2.5-1.5B via LoRA (XLPID), TF-IDF lexical features, and validation-tuned ensembling through late fusion, stacking, and gradient boosting. The framework is evaluated on a synthetic benchmark built from BIPIA(Yi et al., 2023) templates spanning five task families -- email, table, QA, abstract, and code-comprising over 1.43 million generated samples, with train and test splits using mutually exclusive attack categories. Across the experiments, lexical signals prove strong (TF-IDF+SVM F1=0.77), and the hybrid XLPID+TF-IDF ensemble achieves the best overall F1 (0.9205) while the Boosting Ensemble achieves the best AUROC (0.9378). Ensemble methods consistently reduce the English-Bangla cross-lingual gap relative to standalone neural models. The pipeline is designed for extensibility: NLLB-200 supports over 200 languages and XLPID's multilingual backbone can be retargeted to additional languages without architectural changes; empirical validation is currently limited to English and Bangla
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。