首次系统研究机器人感官输入的提示注入攻击，发现大模型未必更安全。
RIPA: Sensory-Vector Prompt Injection Attacks on LLM-Controlled ROS 2 Robots
- 通过视觉、音频、激光雷达三通道注入恶意指令，突破机器人控制
- 70B模型攻击成功率100%，但4B小模型也同样易攻，说明安全不随规模提升
- 提出的防火墙对伪装攻击仍有10.2%绕过率，暴露防御机制缺陷
我们提出RIPA，首个针对基于ROS 2的大型语言模型（LLM）控制机器人系统的多通道感官管道提示注入攻击的系统性实证研究。在五个覆盖四个模型族、参数量从约4B到约284B的LLM（DeepSeek-V4-Flash、Llama-3-8B-Instruct-Lite、Llama-3.3-70B-Instruct-Turbo、Qwen 2.5-7B-Instruct-Turbo、Gemma-3n-E4B）上，每种注入变体进行100次独立测试，发现模型特异性漏洞分布并非单调随规模增长：Llama-3.3-70B-Instruct-Turbo在所有变体中均实现100%攻击成功率（ASR），而Llama-3-8B-Instruct-Lite和Qwen 2.5-7B-Instruct-Turbo对直接覆写攻击完全免疫（0% ASR）；最小模型Gemma-3n-E4B（约4B）与70B模型具有相同脆弱性，表明鲁棒性为模型特定而非规模依赖。我们提出一种混合语义防火墙，在初步良性命令集（0/20）上无误报，但对对抗性混淆攻击（19种混淆载荷，每载荷30次试验，共570次试验）仍存在10.2%的试次加权绕过率。我们进一步引入三种感官注入通道：视觉（通道1，通过OCR）、音频（通道2，通过Whisper语音转文本）、以及激光雷达环境状态污染（通道3）。结果显示，通道3在LLM系统提示层注入伪造障碍物数据，使DeepSeek-V4-Flash在所有变体中达到100%攻击成功率。我们还构建了涵盖五类的19种混淆攻击分类体系。所有代码、数据与结果均公开。
原文摘要 · Abstract (English)
We present RIPA, the first systematic multi-channel empirical study of prompt injection attacks delivered through the sensory pipeline of a ROS 2-based LLM-controlled robotic system. Across 100 independent runs per injection variant on five LLMs spanning four model families and parameter scales from approximately 4B to approximately 284B (DeepSeek-V4-Flash, Llama-3-8B-Instruct-Lite, Llama-3.3-70B-Instruct-Turbo, Qwen 2.5-7B-Instruct-Turbo, Gemma-3n-E4B), we identify model-specific vulnerability profiles that do not follow a monotonic scaling trend: Llama-3.3-70B-Instruct-Turbo exhibits 100% attack success rate (ASR) across all injection variants, while Llama-3-8B-Instruct-Lite and Qwen 2.5-7B-Instruct-Turbo resist direct-override injection (0% ASR), and the smallest model evaluated (Gemma-3n-E4B, approximately 4B) matches the 70B model's vulnerability profile, indicating that robustness is model-specific rather than scale-dependent. We propose a hybrid semantic firewall that achieves 0% ASR against known injection patterns with no false positives on a preliminary benign set (0/20 commands) but exhibits a 10.2% trial-weighted bypass rate (58/570 trials; N equals 30 per payload across 19 obfuscation payloads) against adversarially obfuscated attacks, exposing a critical gap between rule-based and semantic defense layers. We further introduce three sensory injection channels: visual (Channel 1, via OCR), audio (Channel 2, via Whisper STT), and LiDAR sensor context poisoning (Channel 3). We show that Channel 3, which injects fabricated obstacle data into the robot environment-state representation at the LLM system-prompt level, achieves 100% ASR across all variants on DeepSeek-V4-Flash. We also contribute a firewall bypass taxonomy spanning 19 obfuscation payloads across five categories. All code, data, and results are publicly available.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。