发现大模型攻击中注入与执行可分离，仅防注入或执行都不够安全。
Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents
- 提出注入与执行解耦新视角，揭示防御位置比分类器质量更重要。
- 97.5%恶意指令被存储，但执行率仅0%-95%，无相关性。
- 工具层隔离方案Memory Sandbox可使8/9模型攻击成功率归零。
我们发现提示注入成功与工具执行成功是可分离的安全属性：阻止注入的防御不一定能阻止执行，反之亦然。这被称为注入-执行解耦。在具有持久记忆的大模型代理中，恶意指令存储率超过97.5%，但下游执行率在0%至95%之间波动，且与存储率无关。这重塑了威胁模型：仅防止存储不足以为据，阻断执行需在记忆摄入与动作执行间结构化设置权限边界。通过跨九个开源模型（每条件N=40）的5,040次因子实验，评估六种防御在四个架构层级对跨会话边界、经RAG检索触发的延迟攻击的效果，发现防御有效性取决于其相对于攻击权限边界的相对位置，而非分类器质量。仅有工具层防御Memory Sandbox——一种将召回记忆与可执行上下文结构隔离的方案——将八种模型的攻击成功率降至0%。推理模式消融实验揭示双重解耦：单一模式层干预无法同时保障推理与非推理模型类的安全。基于加载语料的前沿评估（21模型，3供应商；基础集N=40，核心模型扩至N=172）显示厂商相关模式：Anthropic 主要在注入层拦截，OpenAI 在执行层拦截并具可变生成强化，预发布版Gemini在多数运行中发生数据外泄。已存储但处于休眠状态的攻击载荷构成共享内存部署中的组合式供应链风险。
原文摘要 · Abstract (English)
We discover that prompt-injection success and tool-execution success are separable safety properties: defenses that block injection do not necessarily block execution, and vice versa. We call this the injection-execution dissociation. In LLM agents with persistent memory, malicious instructions are stored at rates exceeding 97.5%, yet downstream execution ranges from 0% to 95% with no correlation to storage rate. This reframes the threat model: preventing storage alone is insufficient, and blocking execution requires structurally enforcing authority boundaries between memory ingestion and action execution. We substantiate this through a 5,040-run factorial experiment across nine open-source models (N=40 per condition), evaluating six defenses at four architectural layers against delayed-trigger attacks that persist across session boundaries via RAG retrieval. Defense effectiveness is governed by where a defense sits relative to the attack's authority boundary, not by classifier quality. Only Memory Sandbox -- a tool-layer defense that structurally isolates recalled memory from executable context -- reduces attack success to 0% for eight of nine models. A reasoning-mode ablation reveals a double dissociation: no single schema-layer intervention is safe across both reasoning and non-reasoning model classes. A loaded-corpus frontier evaluation (21 models, 3 providers; N=40 base, headline models topped up to N=172) reveals vendor-correlated patterns: Anthropic blocks predominantly at injection, OpenAI blocks at execution with variable generational hardening, and a pre-release Gemini endpoint exfiltrates in the majority of runs. Stored-but-dormant payloads constitute a compositional supply-chain risk in shared-memory deployments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。