研究人员对十款开源提示词注入检测器进行了基准测试，使用629个真实攻击案例和97个良性案例组成的AgentDojo数据集进行评估1。结果显示，这些检测工具在识别隐藏于普通工具输出中的攻击时能力有限1。表现最佳的检测器仅能捕获51%的攻击，同时产生2%的误报1，而Meta的Prompt Guard 2的捕获率仅为1%1。
检测器面临的困境在于难以在攻击指令与合法用户指令之间进行有效区分1。deepset和fmops两款检测器虽然能捕获100%的攻击，但同时也会阻止98%的正常流量1；另有两款检测器则将98%的安全工具输出错误地标记为攻击1。即使调整配置，Prompt Guard 2也未能超过3%的捕获率1。研究表明，基于文本分类的检测方法存在根本局限1。研究人员建议，有效的防御措施应当了解指令来源和工具调用的实际作用，采用基于策略的执行方式比单纯的文本检测更为重要1。
Researchers have conducted a comprehensive benchmark test of ten open-source prompt-injection detectors using 629 real-world attack cases from AgentDojo, revealing significant gaps in their ability to identify malicious instructions hidden within routine tool outputs 1. The best-performing detector among those tested captured only 51% of attacks while generating a 2% false positive rate, whereas Meta's Prompt Guard 2 managed to detect just 1% of attacks 1.
The findings highlight a fundamental limitation in current detection approaches: two detectors achieved 100% attack capture rates but at the cost of blocking 98% of legitimate tool outputs, rendering them impractical for real-world deployment 1. Prompt Guard 2 consistently underperformed across all configurations, never exceeding a 3% detection rate 1. The researchers attribute these poor results to the inadequacy of text-classification-based detection methods, which cannot effectively distinguish between malicious instructions and legitimate user commands 1.
Based on these results, the researchers recommend that effective defenses require understanding the source of instructions and the actual purpose of tool calls, suggesting that policy-based execution controls are more important than text-level detection mechanisms 1.
评论
还没有评论，欢迎留下第一条。