REVIEW 6 cited by
Goal-guided Generative Prompt Injection Attack on Large Language Models
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
abstract
Current large language models (LLMs) provide a strong foundation for large-scale user-oriented natural language tasks. A large number of users can easily inject adversarial text or instructions through the user interface, thus causing LLMs model security challenges. Although there is currently a large amount of research on prompt injection attacks, most of these black-box attacks use heuristic strategies. It is unclear how these heuristic strategies relate to the success rate of attacks and thus effectively improve model robustness. To solve this problem, we redefine the goal of the attack: to maximize the KL divergence between the conditional probabilities of the clean text and the adversarial text. Furthermore, we prove that maximizing the KL divergence is equivalent to maximizing the Mahalanobis distance between the embedded representation $x$ and $x'$ of the clean text and the adversarial text when the conditional probability is a Gaussian distribution and gives a quantitative relationship on $x$ and $x'$. Then we designed a simple and effective goal-guided generative prompt injection strategy (G2PIA) to find an injection text that satisfies specific constraints to achieve the optimal attack effect approximately. It is particularly noteworthy that our attack method is a query-free black-box attack method with low computational cost. Experimental results on seven LLM models and four datasets show the effectiveness of our attack method.
Forward citations
Cited by 6 Pith papers
-
RoguePrompt: Dual-Layer Encoding for Self-Reconstruction to Circumvent LLM Moderation
RoguePrompt, a Vigenère+ROT13 self-reconstruction jailbreak, achieves 70.18% execution@3 and 93.93% bypass@3 across GPT-4o, Claude 3 Opus, and Gemini 1.5 Pro on 313 StrongREJECT prompts.
-
DeRAG: Black-box Adversarial Attacks on Multiple Retrieval-Augmented Generation Applications via Prompt Injection
DeRAG shows that five or fewer tokens found by differential evolution can make black-box RAG retrievers rank a chosen wrong document near the top on small BEIR subsets.
-
LLM Agents Should Employ Security Principles
A position paper proposing AgentSandbox, a framework that applies Saltzer-Schroeder security principles to LLM agents and reports large attack-success-rate reductions on AgentDojo.
-
Multimodal Prompt Injection Attacks: Risks and Defenses for Modern LLMs
Across four attack types, six of eight tested LLMs were successfully injected in at least one category, and GPT-4o failed every test.
-
Prompt-in-Content Attacks: Exploiting Uploaded Inputs to Hijack LLM Behavior
Embedding a short 'system instruction' in a .docx file causes several commercial LLMs to refuse, substitute, redirect, or bias their output during summarization tasks.
-
A Survey on Data Security in Large Language Models
A survey of data security risks in LLMs that organizes threats, defenses, and evaluation datasets, with notable factual errors in its tables.
Discussion (0). Sign in to comment.