研究如何防御大模型代理中的技能注入攻击，提出实时中介防护机制。
Defenses & Enablers For Skill Injection Attacks on Terminal Based Agents
- 用中间代理实时审查技能文件访问，防止恶意指令执行。
- 动态守护者使攻击成功率从81.4%降至18.6%，效果显著。
- 适合关注AI安全与可信代理设计的研究者和开发者。
大型语言模型代理越来越依赖可复用的技能（即描述任务流程的文档），但这也带来了新的攻击面。本文研究了两种互补方向的威胁应对策略：一是评估基于守护者的防御机制，包括在运行时作为中介的动态守护者，或在构建时预重写技能文件的静态守护者。在三个LLM代理家族中，这些守护者将攻击成功率（ASR）降低超过一半，同时保持任务实用性。二是通过四种改写攻击方式对防御进行压力测试，这些攻击保留恶意指令但改变表述。在无守护者设置下，改写攻击使ASR升至81.4%，而动态守护者将其降至18.6%，表明实时中介具有强鲁棒性。
原文摘要 · Abstract (English)
Large language model (LLM) agents increasingly rely on reusable skills i.e. documents describing task-specific procedures. However, this introduces a new attack surface for agents to manage. We study two complementary directions for this threat. First, we evaluate guardian-based defenses: an intermediary LLM agent that acts as a mediator for skill file access (dynamic guardian) or pre-rewrites these files at build time (static guardian). Across three LLM agent families, our guardians cut attack success rate (ASR) by well over half while preserving task utility. Second, we stress test them through attack reframing using four attacks that preserve the malicious instruction but change the phrasing. For non-guardian setup, the reframing pushes the ASR up to 81.4\%, but the dynamic guardian brings it down to 18.6\%, showing that real-time mediation is a robust defense.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。