大模型对齐与安全

WebSentinel: Detecting and Localizing Prompt Injection Attacks for Web Agents

WebSentinel: 检测和定位网页代理中的提示注入攻击

Xilong Wang, Yinuo Liu, Zhun Wang, Dawn Song, Neil Gong

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.AI

AI总结 WebSentinel通过两步方法有效检测和定位网页代理中的提示注入攻击，显著优于现有方法。

Defense Against Indirect Prompt Injection via Tool Result Parsing

通过工具结果解析防御间接提示注入

Qiang Yu, Xinran Cheng, Chuanyi Liu

机构 * Harbin Institute of Technology（哈尔滨工业大学） 纠错

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.AI

AI总结 本文提出通过工具结果解析来防御间接提示注入，有效过滤恶意代码并降低攻击成功率。

Comments 20 pages, 3 figures, 5 tables

When Reject Turns into Accept: Quantifying the Vulnerability of LLM-Based Scientific Reviewers to Indirect Prompt Injection

当拒绝转为接受：量化基于LLM的科学评审员对间接提示注入的脆弱性

Devanshu Sahoo, Manish Prasad, Vasudev Majhi, Jahnvi Singh, Vinay Chamola, Yash Sinha, Murari Mandal, Dhruv Kumar

机构 * BITS Pilani ； KIIT University（KIIT大学） 纠错

专题命中 提示注入 ：prompt injection(title)；jailbreak(abstract)；分类 cs.CL、cs.AI

AI总结 本研究量化了基于LLM的科学评审系统对间接提示注入攻击的脆弱性，揭示了通过隐藏文本注入和布局感知攻击翻转评审决定的风险，并提出WAVS指标评估此类攻击的严重性。

Multilingual Hidden Prompt Injection Attacks on LLM-Based Academic Reviewing

多语言隐藏提示注入攻击对基于LLM的学术评审的影响

Panagiotis Theocharopoulos, Ajinkya Kulkarni, Mathew Magimai. -Doss

机构 * International School of Athens（希腊国际学校） ； Idiap Research Institute（Idiap研究 institute） 纠错

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.AI

AI总结 本研究发现，多语言隐藏提示注入攻击对LLM基于的学术评审系统产生显著影响，尤其在英语、日语和中文中表现明显，而阿拉伯语则影响较小。

May I have your Attention? Breaking Fine-Tuning based Prompt Injection Defenses using Architecture-Aware Attacks

请允许我注意：利用架构感知攻击打破基于微调的提示注入防御

Nishit V. Pandya, Andrey Labunets, Sicun Gao, Earlence Fernandes

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.AI

AI总结 本文提出一种基于注意力的攻击算法，揭示了现有白盒提示注入防御的不足，攻击成功率高达85-95%

How Not to Detect Prompt Injections with an LLM

如何不通过LLM检测提示注入

Sarthak Choudhary, Divyam Anshumaan, Nils Palumbo, Somesh Jha

机构 * University of Wisconsin-Madison（威斯康星大学麦迪逊分校） 纠错

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.AI、cs.LG

AI总结 本文揭示了KAD方案的结构性漏洞，并提出DataFlip攻击方法，能够有效绕过KAD防御，实现低检测率和高恶意行为诱导率。

Securing Large Language Models (LLMs) from Prompt Injection Attacks

保护大型语言模型（LLMs）免受提示注入攻击

Omar Farooq Khan Suri, John McCrae

机构 * University of Galway, Ireland（Galway大学） 纠错

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.LG

AI总结 本研究评估了JATMO方法对提示注入攻击的鲁棒性，发现其在减少攻击成功率的同时仍存在漏洞，提示需要更复杂的防御策略。

Comments 10 pages, 1 figure, 1 table

AEGIS : Automated Co-Evolutionary Framework for Guarding Prompt Injections Schema

Ting-Chun Liu, Ching-Yu Hsu, Kuan-Yi Lee, Chi-An Fu, Hung-yi Lee

机构 * Electrical Engineering, National Taiwan University（国家台湾大学电子工程系） 纠错

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.AI、cs.LG

IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents

Hengyu An, Jinghuai Zhang, Tianyu Du, Chunyi Zhou, Qingming Li, Tao Lin, Shouling Ji

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.AI

Comments EMNLP 2025

Detection Method for Prompt Injection by Integrating Pre-trained Model and Heuristic Feature Engineering

Yi Ji, Runzhi Li, Baolei Mao

机构 * Zhengzhou University（郑州大学） 纠错

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.AI

Comments Accepted by KSEM2025 AI & Sec Workshop

Attention Tracker: Detecting Prompt Injection Attacks in LLMs

Kuo-Han Hung, Ching-Yun Ko, Ambrish Rawat, I-Hsin Chung, Winston H. Hsu, Pin-Yu Chen

机构 * IBM Research（IBM研究院） ； National Taiwan University（国立台湾大学） 纠错

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.AI、cs.LG

Comments Project page: https://huggingface.co/spaces/TrustSafeAI/Attention-Tracker

InjecGuard: Benchmarking and Mitigating Over-defense in Prompt Injection Guardrail Models

Hao Li, Xiaogeng Liu

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.AI

Prompt Injection Attacks on Large Language Models in Oncology

Jan Clusmann, Dyke Ferber, Isabella C. Wiest, Carolin V. Schneider, Titus J. Brinker, Sebastian Foersch, Daniel Truhn, Jakob N. Kather

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.AI、cs.LG

Comments 57 Pages, 5 Figures

Prompt Injection Detection and Mitigation via AI Multi-Agent NLP Frameworks

Diego Gosmar, Deborah A. Dahl, Dario Gosmar

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.AI

Comments 22 pages, 9 figures

Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models

Jingwei Yi, Yueqi Xie, Bin Zhu, Emre Kiciman, Guangzhong Sun, Xing Xie, Fangzhao Wu

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.AI

Comments Accepted by KDD 2025

Trust No AI: Prompt Injection Along The CIA Security Triad

Johann Rehberger

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.AI、cs.LG

Comments Based on research presented at Black Hat Europe 2024, Microsoft Bluehat 2024 and publications from embracethered.com

Fine-tuned Large Language Models (LLMs): Improved Prompt Injection Attacks Detection

Md Abdur Rahman, Fan Wu, Alfredo Cuzzocrea, Sheikh Iqbal Ahamed

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.AI

Comments I am requesting the withdrawal of my paper due to critical issues identified in the methodology/results that may impact its accuracy and reliability. I also plan to make substantial revisions that go beyond minor corrections

Palisade -- Prompt Injection Detection Framework

Sahasra Kokkula, Somanathan R, Nandavardhan R, Aashishkumar, G Divya

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.AI

Empirical Analysis of Large Vision-Language Models against Goal Hijacking via Visual Prompt Injection

Subaru Kimura, Ryota Tanaka, Shumpei Miyawaki, Jun Suzuki, Keisuke Sakaguchi

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.LG

Comments 8 pages, 6 figures, Accepted to NAACL 2024 SRW

How Far Can In-Context Alignment Go? Exploring the State of In-Context Alignment

Heyan Huang, Yinghao Li, Huashan Sun, Yu Bai, Yang Gao

专题命中 提示注入 ：alignment(title,abstract)；分类 cs.CL、cs.AI

Comments 22 pages, 6 figures, work in progress

Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection

Jun Yan, Vikas Yadav, Shiyang Li, Lichang Chen, Zheng Tang, Hai Wang, Vijay Srinivasan, Xiang Ren, Hongxia Jin

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.LG

Comments Accepted to NAACL 2024. Project page: https://poison-llm.github.io

Defending Against Indirect Prompt Injection Attacks With Spotlighting

Keegan Hines, Gary Lopez, Matthew Hall, Federico Zarfati, Yonatan Zunger, Emre Kiciman

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.LG

An Early Categorization of Prompt Injection Attacks on Large Language Models

Sippo Rossi, Alisia Marianne Michel, Raghava Rao Mukkamala, Jason Bennett Thatcher

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.LG

Comments 21 pages double spacing

Jatmo: Prompt Injection Defense by Task-Specific Finetuning

Julien Piet, Maha Alrashed, Chawin Sitawarin, Sizhe Chen, Zeming Wei, Elizabeth Sun, Basel Alomair, David Wagner

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL、cs.AI

Comments 24 pages, 6 figures

Detecting Prompt Injection Attacks Against Application Using Classifiers

使用分类器检测应用于应用程序中的提示注入攻击

Safwan Shaheer, G. M. Refatul Islam, Mohammad Rafid Hamid, Md. Abrar Faiaz Khan, Md. Omar Faruk, Yaseen Nur

机构 * Department of Computer Science (CS)（计算机科学系） ； Department of Computer Science and Engineering (CSE)（计算机科学与工程系） ； School of Data and Sciences (SDS)（数据与科学学院） 纠错

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.AI

AI总结 本研究通过训练多种分类器，旨在检测网络应用中的提示注入攻击，提升系统安全性和稳定性。

Comments 9 pages, X figures; undergraduate research project on detecting prompt injection attacks against LLM integrated web applications using classical machine learning and neural classifiers

Assessing Prompt Injection Risks in 200+ Custom GPTs

Jiahao Yu, Yuhang Wu, Dong Shu, Mingyu Jin, Sabrina Yang, Xinyu Xing

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.AI；trustworthy(comments)

Comments Accepted in ICLR 2024 Workshop on Secure and Trustworthy Large Language Models

HIPO: Instruction Hierarchy via Constrained Reinforcement Learning

HIPO：通过约束强化学习实现指令层级

Keru Chen, Jun Luo, Sen Lin, Yingbin Liang, Alvaro Velasquez, Nathaniel Bastian, Shaofeng Zou

机构 * School of ECEE Arizona State University（亚利桑那州立大学电子与计算机工程学院） ； Department of ECE The Ohio State University（俄亥俄州立大学电子工程系） ； Computer Science Department University of Houston（休斯顿大学计算机科学系） ； College of Engineering & Applied Science CU Boulder（科罗拉多大学博尔德分校工程与应用科学学院） ； Dept. of Electrical Engineering & Computer Science United States Military Academy（美国军事学院电子工程与计算机科学系） 纠错

专题命中 提示注入 ：alignment(abstract)；RLHF(abstract)；DPO(abstract)；分类 cs.CL、cs.AI、cs.LG

AI总结 HIPO通过约束马尔可夫决策过程解决层级指令遵循问题，提升系统合规性与用户效用。

Comments 9 pages + appendix. Under review

Covert Visual Prompt Injection against Commercial Multimodal Large Language Models

对抗性提示注入攻击多模态大语言模型

Meiwen Ding, Song Xia, Chenqi Kong, Xudong Jiang

机构 * Rapid-Rich Object Search Lab, School of Electrical and Electronic Engineering, Nanyang Technological University（南洋理工大学电气与电子工程学院快速丰富目标搜索实验室） 纠错

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.AI

AI总结 本文研究了针对强大闭源多模态大语言模型的不可察觉视觉提示注入攻击，通过界文本叠加嵌入恶意提示并优化视觉扰动，提升攻击性能。

Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection

并非无障碍功能（A11y）：安卓无障碍功能如何将移动智能体暴露于间接提示注入攻击

Rahul Deivasigamani, Sayeda Faatin Alvi, Derqui Andrea, Kaushal Punjabi, Stjepan Picek

机构 * Radboud University Nijmegen（奈梅亨拉德堡德大学） 纠错

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.AI

AI总结 本文揭示安卓移动智能体框架因依赖未过滤的无障碍元数据，存在间接提示注入漏洞，经实证验证其攻击成功率达0.822，需强化零信任输入验证等安全措施。

Toward Metacognitive One-Shot Indirect Prompt Injection: Strategy Abstraction Via Outcome-Conditioned Reflection

迈向元认知少样本间接提示注入：基于结果条件反射的策略抽象

Sihan Hou, Xinmeng Hou, Zhijun Zhang, Zehao Wang, Xuhong Ren, Sibo Qin, Kuntharrgyal Khysru, Qing Guo

专题命中 提示注入 ：prompt injection(title,abstract)；分类 cs.CL

AI总结 本文提出SAVOR方法，将攻击适配转向离线策略蒸馏，仅需一次目标智能体查询，在多基准与模型上攻击成功率显著优于现有方法，且记忆可跨防御迁移。