动态分配检测器，提升对抗提示注入攻击的效率与安全。
Send a SCOUT First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defense
- 根据历史行为预测检测器可靠性与延迟，动态选择最佳组合
- 在SCOUT-450上降低46%攻击成功率，减少40%运行时间
- 支持安全与效率权衡，适合需要高可靠性的应用
提示注入检测器具有异质性：每个检测器对不同类型的攻击表现优异，但无一始终可靠。现有系统仍采用固定单检测器流程，导致请求被投入特定检测器的盲区。本文将防御重构为检测器分配问题：基于异质检测器池，针对每条请求决定启用哪些检测器，并判断是否升级至大模型判断器。提出的框架SCOUT（可扩展且可控的不确定性感知分流预测）通过分析检测器在相似历史输入上的行为，动态预测其每样本的可靠性与延迟，并向操作者暴露单一安全-效用阈值（效用包含良性通过率与实际耗时）。为评估该设定，构建了SCOUT-450基准，涵盖结构复杂、面向代理的提示注入攻击，弥补旧有数据集的不足。在该基准上，以安全为导向的运行点相比始终启用GPT-4o判断器，攻击成功率降低46%，总运行时间减少40%，良性效用仅下降5.1点。SCOUT在三个外部基准（BIPIA、IPI、IHEval）中亦表现出色，优化了安全-效用边界。
原文摘要 · Abstract (English)
Prompt-injection detectors are heterogeneous: each is strong on a different slice of attacks, and none is always reliable. Yet existing systems still treat detection as a fixed single-detector pipeline, committing every request to one detector's blind spots. We reframe defense as detector allocation: given a heterogeneous pool, decide per request which detectors to run and whether to escalate to an LLM judge. Our framework SCOUT (Scalable and Controllable Outcome-prediction for Uncertainty-aware Triage) makes this decision dynamic by predicting each detector's per-sample reliability and latency from how it behaved on similar past inputs, and exposes a single safety-utility threshold to the operator (where utility bundles benign-pass rate and wall-clock). To evaluate this setting, we build SCOUT-450, a benchmark that captures the structurally complex, agent-facing injections that older prompt-injection sets under-represent. On SCOUT-450, a safety-oriented operating point reduces attack-success rate by 46% and total wall-clock by 40% relative to an always-on GPT-4o judge, at a 5.1-point benign-utility drop. SCOUT also transfers to three external benchmarks (BIPIA, IPI, and IHEval), improving the safety-utility frontier.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。